Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add echoVic/boss-skill --skill test-strategygit clone --depth 1 https://github.com/echoVic/boss-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/echovic/boss-skill/test-strategy)<a href="https://agentmods.dev/skills/echovic/boss-skill/test-strategy"><img src="https://agentmods.dev/badge/skills/echovic/boss-skill/test-strategy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/echovic/boss-skill/test-strategy"><img src="https://agentmods.dev/badge/skills/echovic/boss-skill/test-strategy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00790 |
| Opus 5.5 | $0.00013 | $0.00316 |
| Sonnet 5.5 | $0.00007 | $0.00158 |
| Haiku 4.5 | $0.00003 | $0.00079 |
Grade A, and why
qa/test-strategy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
测试策略与测试金字塔
测试金字塔原则
/\
/ \
/ E2E \ ← ~10%：端到端用户流程【必须编写】
/--------\
/ 集成测试 \ ← ~20%：组件/服务/API 交互
/--------------\
/ 单元测试 \ ← ~70%：函数/组件/服务逻辑
/--------------------\
E2E 测试是强制要求
每个项目必须编写 E2E 测试，最少覆盖：
- 创建流程
- 编辑流程
- 删除流程
- 列表展示
- 核心业务流程
前端 vs 后端测试分布
| 层级 | 前端测试 | 后端测试 |
|---|---|---|
| 单元测试 | 组件渲染、Hooks、工具函数 | Service 层、业务逻辑、工具类 |
| 集成测试 | 组件交互、状态管理、API 调用 | API 端点、数据库操作、服务间调用 |
| E2E 测试 | UI 用户流程 | API 完整流程、跨服务调用 |
QA Attack Protocol
- 重放核心用户路径：证明核心用户路径真实可用
- 捕获真实 payload 与服务端响应：验证请求 payload、服务端响应和 schema 一致性
- 攻击认证授权：覆盖匿名、授权、非授权、过期、越权
- 攻击数据边界：empty state、pagination、第二页、旧数据、illegal enum、long input、double submit
- 攻击业务一致性：核对界面展示与服务端业务常量一致
- 验证产物类功能：验证核心产物、记录或状态存在、可展示、可继续用于下游流程
- 标记未验证路径：若核心用户路径只由 Mock 或桩数据证明，必须标记为未验证，不能作为发布证据
安全测试
| 测试类型 | 测试内容 | 示例 |
|---|---|---|
| SQL 注入 | 参数化查询验证 | ' OR '1'='1 |
| XSS | 输出转义验证 | <script>alert(1)</script> |
| CSRF | Token 验证 | 跨站请求测试 |
| 认证 | Token 有效性 | 过期/伪造 Token |
| 授权 | 权限边界 | 越权访问测试 |
| 输入验证 | 边界值/格式 | 超长/特殊字符 |
性能测试
| 指标 | 前端目标 | 后端目标 |
|---|---|---|
| 首屏加载 | < 3s | - |
| API P50 | - | < 100ms |
| API P99 | - | < 500ms |
| 并发用户 | - | ≥ 100 |
| 内存泄漏 | 无 | 无 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 20d ago Changed · +2 lines fcd3f7c79870
- 1mo ago First seen · 78 lines · 33 tokens per session scan A cc3763c4dd93
qa/test-strategy is a skill published in the GitHub repository echoVic/boss-skill (543 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 790 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-runner
For a code change, pick the right test tier by change surface, run apc test with baseline diff, and report only NEW reds vs baseline back to the task's acceptance criterion. Separates envblocked from SUT red so a broken machine never fails the code.
designing-tests
Designs and implements testing strategies for any codebase. Use when adding tests, improving coverage, setting up testing infrastructure, debugging test failures, or when asked about unit tests, integration tests, or E2E testing.
testing
Use when writing or reviewing Flutter/Dart tests (unit, widget, golden), fixing flaky tests, adding coverage, or choosing between unit and widget tests.
Codeception Testing
Expert-level Codeception testing skill for PHP applications. Covers acceptance, functional, and unit testing with the Actor pattern, BDD-style syntax, Page Objects, API testing, and database helpers.
JMeter Load Testing
Load and performance testing skill using Apache JMeter, covering test plans, thread groups, assertions, listeners, timers, and distributed testing.
claude-code-qa
The complete QA skill for Claude Code — turn Claude into an expert QA engineer that picks the right test type, writes reliable Playwright, Cypress, and pytest tests, eliminates flaky tests, enforces coverage, and wires up CI. Claude Code QA testing done right.