Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/fishzjp/qa-skillsnpx agentmods add skills/fishzjp/qa-skills/exploratory-testingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fishzjp/qa-skills/exploratory-testing)<a href="https://agentmods.dev/skills/fishzjp/qa-skills/exploratory-testing"><img src="https://agentmods.dev/badge/skills/fishzjp/qa-skills/exploratory-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fishzjp/qa-skills/exploratory-testing"><img src="https://agentmods.dev/badge/skills/fishzjp/qa-skills/exploratory-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.01997 |
| Opus 5.5 | $0.00043 | $0.00799 |
| Sonnet 5.5 | $0.00022 | $0.00399 |
| Haiku 4.5 | $0.00011 | $0.00200 |
Grade A, and why
exploratory-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
探索式测试（exploratory-testing）
需求不完整、系统陌生、文档不足时的独立探索式测试会话：charter 驱动，边探索边设计，产出系统理解与风险清单，而不是执行既有用例。
- 输入：被测系统入口（环境 + 账号）、探索主题或 charter、（可选）已有需求材料
- 输出（落盘）：
{项目}/探索笔记_{主题}.md（charter、系统理解、风险清单、测试想法、发现的 Bug）——旁路场景下作为requirement-analysis的输入 - 适用：新系统、老系统、文档缺失、黑盒测试、Agent 自主测试
When to Use
- 新接手/陌生的系统，文档缺失或不可信，先探索再建模
- 需求不完整，需要用探索补齐系统理解与风险清单
- 黑盒环境（只有入口和账号）下的自主测试
When NOT to Use
- 为写自动化踩点（理解页面结构、提取选择器、落 Page Object）→
automated-e2e-testing工作流零（业务熟悉） - 按既有用例执行 →
automated-e2e-testing（UI）/api-testing（接口） - 已确认 Bug 的根因分析 →
bug-analysis - 端到端流水线 →
qa（本 skill 是其旁路阶段 0）
探索笔记 Schema（产出结构）
# 探索笔记：{主题}
## Charter（本轮探索的使命）
- 目标：{回答什么问题 / 覆盖什么区域}
- 范围：{系统/模块/流程}
- 时长/停点：{时间盒或停止条件}
## 系统理解（探索中修正）
- 入口与导航路径 / 角色与权限 / 核心流程 / 数据流向 / 状态与流转
## 风险清单（每条带证据标注，此时加载 `../core/evidence.md`）
- R?：{风险描述}｜level: {Critical/High/Medium/Low，按 `../core/risk-model.md` 的 Impact × Likelihood 预评}｜evidence: {E0–E4 + 来源}｜confidence: {high/medium/low}｜status: {fact / inference / risk / hypothesis}
（R? 为会话内临时编号；移交 `test-strategy` 时并入其 Risk Map 统一重编为 R1…，探索笔记原文编号不保留）
## 测试想法（后续转化为正式用例的候选）
- 想法 → 建议归属：{test-case-writing 直接产出 / 需先澄清的问题}
## 发现的 Bug（现象 + 复现步骤 + 证据；未定性，标 Hypothesis）
## 未解之谜（需要用户/开发澄清的问题）
工作流
1. 制定 Charter（先定使命，再动手）
- Charter 三要素：目标（回答什么问题，如"优惠券领取的前置约束有哪些"）、范围（哪个系统/流程）、停点（时间盒或"风险清单满 10 条"）
- 主题未知时与用户对齐一句："这轮探索想弄清楚什么？"
- 无环境/账号 → 先索取（入口地址、每角色账号、数据说明），不开无凭据的探索
2. 系统摸底（建初始地图）
- 登录 → 枚举入口与导航路径 → 记录角色可见的功能面
- 走一遍可发现的主流程，记录：页面/接口、数据对象、状态与流转
- 使用宿主可用的浏览器自动化能力（导航、截图、API 监听/抓包）采集证据，以本 skill 的笔记结构为产出——会话与产出归本 skill，不为此加载其他执行 skill 的指令；宿主/环境无浏览器自动化能力时降级为人工探索（测试工程师按手动步骤操作 + 人工截图/抄录响应），笔记结构与证据标注不变，仅证据采集效率下降
3. 探索循环（边设计边执行边记录）
按 charter 目标循环：假设 → 触发 → 观察 → 记录：
| 探索启发式 | 问的问题 |
|---|---|
| 输入极值 | 空值/超大/特殊字符/负数，系统怎么拦 |
| 状态穿越 | 跳步操作（未达前置直接触发后续）、逆向操作、重复操作 |
| 并发与竞态 | 两个会话同时操作同一对象 |
| 数据生命周期 | 创建→修改→删除→再查，残留吗；级联对象怎么办 |
| 权限边界 | 换角色/退出登录后重放同一操作（含直接调接口） |
| 错误恢复 | 失败后重试、断网重连、超时后的状态 |
| 平台与环境 | 换浏览器/分辨率/弱网/系统配置开关，行为还一致吗 |
| 时间与时钟 | 零点/跨天边界、过期与定时任务触发时机，状态与文案对吗 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed c0df82d8678b
- 1mo ago Changed · -7 tokens per session dffaf6714a41
- 1mo ago Changed · +1 lines 14c4ffb27b28
- 1mo ago Changed c7e10f7dbee1
- 1mo ago First seen · 109 lines · 115 tokens per session scan A f4450bfeca55
exploratory-testing is a skill published in the GitHub repository fishzjp/qa-skills (50 stars, last pushed 3d ago), licensed MIT. It adds 108 tokens to every session and 1,997 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
qa-expert
Expert-level quality assurance, testing strategies, automation, and QA processes. Use when the user mentions testing, test automation, quality assurance, or Selenium, or when the task involves Testing Types, QA Processes, Test Strategy, or Defect Management.
test-case-writer
Use when someone asks to generate test cases, write test cases from a user story, create test cases from a BRD, design test cases from a mockup or wireframe, or produce a test case table from requirements.
test-review
A review checklist for newly written or changed automated tests using TypeScript and Playwright. Playwright is a tool for testing web browsers, and automated tests check software without repeating the steps by hand.
testrail-qa
Work with TestRail through the TestRail MCP Server — find where cases live, write schema-valid test cases, build targeted test runs, triage failures, and report results by case ID. Use when the user mentions TestRail, test cases (C123), test runs, test results, regression suites, or QA coverage.
qa-engineer
QA specialist agent for test planning, execution, and regression analysis.
playwright-expert
Expert in Playwright E2E testing framework, auto-waiting mechanisms, test generation, trace viewer, and CI/CD integration. Use when the user mentions testing, end-to-end tests, QA, automation, end-to-end testing, or test automation, or when the task involves Playwright Framework, Test Organization, Advanced Features…