Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Evyasys-Software-Solutions/EvyaGovernance --skill evyasys-finish-qagit clone --depth 1 https://github.com/Evyasys-Software-Solutions/EvyaGovernanceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-finish-qa)<a href="https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-finish-qa"><img src="https://agentmods.dev/badge/skills/evyasys-software-solutions/evyagovernance/evyasys-finish-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-finish-qa"><img src="https://agentmods.dev/badge/skills/evyasys-software-solutions/evyagovernance/evyasys-finish-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.00439 |
| Opus 5 | $0.00044 | $0.00219 |
| Sonnet 5 | $0.00017 | $0.00088 |
| Haiku 4.5 | $0.00009 | $0.00044 |
Grade A, and why
evyasys-finish-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: evyasys-finish-qa
A release gate — a story cannot move to Done unless every quality gate is passed. No test case may remain without a recorded outcome. No P0 or P1 defect may be open.
Gates that must pass
| Gate | Requirement |
|---|---|
| TC completeness | Every test case in the test plan has Pass / Fail / Blocked recorded |
| Defect gate | No P0 (critical / data loss / security) or P1 (broken AC / regression) open |
| AC sign-off | Every AC signed off by Product Owner — or formally waived with a follow-up story ID |
| Security gate | Auth, input validation, and PII tests passed — if Security flag set |
| Performance gate | All response time measurements at or below PERFORMANCE.md budget — if Performance flag set |
| Accessibility gate | Keyboard nav, ARIA, colour contrast verified — if Frontend flag set |
| Data integrity gate | Migration up/down, FK constraints verified — if DB flag set |
Release notes quality bar
- Plain, user-facing language — no class names, no internal IDs, no jargon
- Every user-visible change mentioned
- Breaking changes called out explicitly
- Roll-back plan documented (or "N/A — purely additive")
Architect gate
After QA, any security edge cases or performance threshold violations discovered during testing are flagged for doc update in SECURITY.md or PERFORMANCE.md respectively.
Output
.evyasys/board/**/<StoryID>/<StoryID>_ReleaseNotes.md- ADO state → Done
- Teams release card posted
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 39 lines · 87 tokens per session scan A 3c8944d788b4
evyasys-finish-qa is a skill published in the GitHub repository Evyasys-Software-Solutions/EvyaGovernance (7 stars, last pushed 1mo ago), licensed MIT. It adds 87 tokens to every session and 439 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
michel-create-packmind-dataset
Seed a local Packmind instance with a realistic dataset — one organization populated with standards, commands, and skills — so an autonomous agent can exercise its own changes against lifelike data instead of an empty app. Use this whenever you need populated Packmind data to verify a change end-to-end: reproducing a…
app-user-story-qa
End-to-end app feature inventory and user-story testing workflow with a canonical tracker. Use when the user asks to audit every feature, derive expected behavior from code, test user journeys, or explicitly fix and retest documented UX or logistical defects.
elegant-architecture
Guides clean architecture design with strict 200-line file limits. Use when starting new features, refactoring large files, or planning module structure. Enforces modular design and real testing.
skill-lifeguard
Use when a skill is brittle, drifting, repeatedly failing, or needs a Reliable Skill Contract. Trigger for phrases like skill lifeguard, reliable skill, self-maintaining skill, negative examples, verification checkpoints, drift signals, replay hooks, or failure log to skill patch. Audits or patches skills so…
test-driven-development
Enforces TDD discipline with RED-GREEN-REFACTOR cycle. Use when writing new features, fixing bugs, or refactoring code. Ensures tests genuinely verify behavior.
playwright-automation
Browser automation and testing with Playwright. Use when testing web applications, automating browser tasks, taking screenshots, or validating UI behavior.