Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Evyasys-Software-Solutions/EvyaGovernance --skill evyasys-start-qagit clone --depth 1 https://github.com/Evyasys-Software-Solutions/EvyaGovernanceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-start-qa)<a href="https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-start-qa"><img src="https://agentmods.dev/badge/skills/evyasys-software-solutions/evyagovernance/evyasys-start-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evyasys-software-solutions/evyagovernance/evyasys-start-qa"><img src="https://agentmods.dev/badge/skills/evyasys-software-solutions/evyagovernance/evyasys-start-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.00521 |
| Opus 5 | $0.00052 | $0.00260 |
| Sonnet 5 | $0.00021 | $0.00104 |
| Haiku 4.5 | $0.00010 | $0.00052 |
Grade A, and why
evyasys-start-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: evyasys-start-qa
A test plan is only as good as the environment it runs in. This skill has a HARD-GATE before writing test cases: test environment and data availability must be confirmed. A plan that can't be executed is not a plan.
What it reads
- Story ACs and Impacted Areas flags — flags drive which quality-gate docs are loaded
- Dev Summary — "Files touched" drives regression scope; "Manual QA hints" are starting points
- Code Review artefact (if present) — flagged issues become edge cases
TESTING.md— always; test strategy, naming rules, coverage requirements, mocking policySECURITY.md— if Security flag setPERFORMANCE.md— if Performance flag setFRONTEND.md+DESIGN_SYSTEM.md— if Frontend flag setDB_STANDARDS.md— if DB flag set
Test plan structure
| Section | Content |
|---|---|
| AC-driven cases | ≥1 positive + ≥1 negative per AC; Gherkin for multi-step scenarios |
| Edge cases | ≥2 per major workflow branch: empty, max, concurrent, timezone, permissions, network failure |
| Regression checks | ≥1 per file touched; ≥2 per file marked high-risk in Dev Summary |
| Security tests | Every protected endpoint → 401/403; every user-controlled field → invalid input |
| Performance tests | Response time target from PERFORMANCE.md as explicit pass/fail threshold |
| Accessibility | Keyboard nav, ARIA labels, colour contrast — if Frontend flag |
| Data integrity | FK constraints, cascade, migration up/down — if DB flag |
Output
.evyasys/board/**/<StoryID>/<StoryID>_TestPlan.md- ADO state → In QA
- Teams QA-started card posted
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 40 lines · 104 tokens per session scan A e55642cc4047
evyasys-start-qa is a skill published in the GitHub repository Evyasys-Software-Solutions/EvyaGovernance (7 stars, last pushed 29d ago), licensed MIT. It adds 104 tokens to every session and 521 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
michel-create-packmind-dataset
Seed a local Packmind instance with a realistic dataset — one organization populated with standards, commands, and skills — so an autonomous agent can exercise its own changes against lifelike data instead of an empty app. Use this whenever you need populated Packmind data to verify a change end-to-end: reproducing a…
app-user-story-qa
End-to-end app feature inventory and user-story testing workflow with a canonical tracker. Use when the user asks to audit every feature, derive expected behavior from code, test user journeys, or explicitly fix and retest documented UX or logistical defects.
elegant-architecture
Guides clean architecture design with strict 200-line file limits. Use when starting new features, refactoring large files, or planning module structure. Enforces modular design and real testing.
skill-lifeguard
Use when a skill is brittle, drifting, repeatedly failing, or needs a Reliable Skill Contract. Trigger for phrases like skill lifeguard, reliable skill, self-maintaining skill, negative examples, verification checkpoints, drift signals, replay hooks, or failure log to skill patch. Audits or patches skills so…
test-driven-development
Enforces TDD discipline with RED-GREEN-REFACTOR cycle. Use when writing new features, fixing bugs, or refactoring code. Ensures tests genuinely verify behavior.
playwright-automation
Browser automation and testing with Playwright. Use when testing web applications, automating browser tasks, taking screenshots, or validating UI behavior.