Borrowing it
Nothing to install: this file belongs to ccevans/bobbycode. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ccevans/bobbycode/main/.claude/skills/bobby-qe/SKILL.mdgit clone --depth 1 https://github.com/ccevans/bobbycodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccevans/bobbycode/bobby-qe)<a href="https://agentmods.dev/skills/ccevans/bobbycode/bobby-qe"><img src="https://agentmods.dev/badge/skills/ccevans/bobbycode/bobby-qe/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccevans/bobbycode/bobby-qe"><img src="https://agentmods.dev/badge/skills/ccevans/bobbycode/bobby-qe.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02194 |
| Opus 5 | $0.00044 | $0.01097 |
| Sonnet 5 | $0.00018 | $0.00439 |
| Haiku 4.5 | $0.00009 | $0.00219 |
Grade A, and why
test-app scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **API Testing** — Direct HTTP endpoint testing via curl/bash scripts. Test data contracts, error handling, auth flows, and edge cases. How it starts
The opening of the file, as written. The whole thing — 255 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bobby QE Skill
Comprehensive quality engineering for web applications. Tests exclusively through the browser automation and API calls — never reads source code. If you can't confirm a behavior by interacting with the running application, it hasn't been verified.
Testing Methods
<testing_boundaries> QE verifies behavior exclusively through what users can observe:
- UI Testing — Browser-based testing using browser automation (screenshots, clicks, form fills, page reads, navigation). Test what users actually see.
- API Testing — Direct HTTP endpoint testing via curl/bash scripts. Test data contracts, error handling, auth flows, and edge cases.
- Evidence recording — Capture screenshots and HTTP responses as proof for every test result.
When a test cannot be performed through UI or API (e.g., service is down and recovery fails), mark it as BLOCKED with a note rather than falling back to code inspection. Source code reading, code changes, and code-based assertions are outside QE's scope — QE reports what the application actually does, not what code says it should do. </testing_boundaries>
Before Starting
- Check learnings — Read
.claude/skills/bobby-qe/learnings.md+.claude/skills/bobby-qe/learnings.local.md - Health check — Verify dev environment:
Service Recovery (Self-Unblocking)
Before marking tests as BLOCKED, attempt to restore services.
Step 1: Health Check
curl -s -o /dev/null -w "%{http_code}" <your dev server URL> || echo "APP DOWN — configure health_checks in .bobbyrc.yml"
Boundaries:
- One restart attempt per service — if it doesn't come back, it's BLOCKED
- Never run migrations, installs, or edit config files
- Never debug application logs for code issues
Ticket Queue: Auto-Processing
When acting as QE, check for tickets in the testing stage:
bobby ticket list testing
Pick up tickets automatically in priority order (critical > high > medium > low). Don't ask which ticket — just start testing.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 255 lines · 88 tokens per session scan A ebb29b24432b
test-app is a skill published in the GitHub repository ccevans/bobbycode (6 stars, last pushed 3d ago), licensed MIT. It adds 88 tokens to every session and 2,194 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
agent-browser
Use the host-side agent-browser CLI for local browser smoke tests, screenshots, snapshots, and simple UI validation against forwarded localhost URLs.
e2e
Generate and run Playwright E2E tests traced to spec.md acceptance criteria, with an optional accessibility audit. Use when saying "e2e tests" or "a11y audit".
hatch3r-browser-verify
Opt-in browser verification skill — spec-run-first Playwright verification (assertions execute in the runner, agent reads only failures), axe-core a11y audits, toHaveScreenshot() regression diffs, E2E test scaffolds, and snapshot-mode exploratory driving. Default ON for UI-affecting agent invocations; disable globally…
tauri-pilot
Inspect, interact with, and test a running Tauri v2 app via CLI. Communicates over Unix socket using JSON-RPC 2.0. Use when testing UI, automating interactions, or debugging a Tauri app.
sc:webapp-testing
Test a web app end-to-end with Playwright: drive real flows, assert on visible state, catch console/network errors, and do visual + RTL/Hebrew checks. Covers writing resilient selectors (roles/text over CSS), waiting on conditions (never sleeps), screenshot diffing, and a quick smoke pass before shipping. Activate…