Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fishzjp/qa-skills --skill test-strategygit clone --depth 1 https://github.com/fishzjp/qa-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fishzjp/qa-skills/test-strategy)<a href="https://agentmods.dev/skills/fishzjp/qa-skills/test-strategy"><img src="https://agentmods.dev/badge/skills/fishzjp/qa-skills/test-strategy.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.03840 |
| Opus 5 | $0.00047 | $0.01920 |
| Sonnet 5 | $0.00019 | $0.00768 |
| Haiku 4.5 | $0.00009 | $0.00384 |
Grade A, and why
test-strategy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
测试策略(test-strategy)
回答"这个功能应该怎么测"——把风险翻译成两域测试范围与深度。策略位于"需求 → 风险分析 → 策略 → 测试设计 → 用例"链路中,跳过策略直接写用例是本框架明确反对的。
- 输入:需求模型(
需求模型.md;没有则内联轻量研读需求源)、代码仓库、系统架构、历史 Bug - 输出(落盘):
{项目}/测试策略.md(Risk Map + 两域 scope + depth_budget);有 handoff / blocked / 外部执行器轴时另产{项目}/专项移交_{轴}_{日期}.yaml - 边界:不写具体用例(→
test-case-writing);不代替用户裁决(自动化提案、预算裁决均 ⏸ 等确认);覆盖范围限于系统级黑盒(UI / API / 手动 / 专项移交)——单元/集成测试是开发侧职责,本策略的风险评级与"已覆盖"结论均以该层已有保障为假设前提(假设未验证时在测试报告标注,防"系统级全过 = 质量有保障"的误读)
When to Use
- "这个功能应该怎么测"——需要范围 / 类型 / 深度 / 优先级的策略决策与理由
- 需要识别风险并评级(Risk Map),作为用例优先级与回归锚点的依据
- 需要决定测试类型取舍(性能 / 安全 / 可靠 / 兼容等哪些测、测多深、哪些明确不测)并留痕
- 需要制定自动化计划提案与长期回归策略
When NOT to Use
- 端到端测试整个需求 →
qa编排 - 需要系统性需求建模 →
requirement-analysis - 已有策略、直接写用例 →
test-case-writing - 代码变更后判断回归范围 →
regression-testing(本 skill 的 regression_plan 是长期回归策略,不是某次 diff 的范围选择)
测试策略 Schema(产出结构)
test_strategy:
feature:
functional_scope: # 功能域:范围+深度+理由(含 state / data_consistency 两轴;rationale 每轴必带,示例仅演示写法)
functional: { include: true, depth: full, rationale: "核心资损路径", risk_refs: [R3] }
boundary: { include: true, depth: standard, rationale: "入参边界密集(金额/时限)" }
permission: { include: true, depth: full, rationale: "越权高危", risk_refs: [R2] }
state: { include: true, depth: standard, rationale: "券状态流转多分支" }
data_consistency: { include: true, depth: standard, rationale: "库存与订单跨表一致" }
regression: { include: true, depth: standard, rationale: "存量功能回归基线" }
type_scope: # 类型域:十轴全轴必答,每轴单行 flow 风格(校验器按行解析)
performance: { decision: include, depth: full, signals: ["PRD-4.2 SLA", "order_service.go:88"], risk_refs: [R3], executor: k6, execution_status: blocked, todo: "向运维索取独立压测环境", handoff_ref: "专项移交_性能_{日期}.yaml" }
security_business: { decision: include, depth: standard, signals: ["多角色", "内部信号:permission≥standard"] }
reliability: { decision: include, depth: standard, signals: ["retry: pay_service.go:41"] }
concurrency: { decision: include, depth: standard, signals: ["库存扣减", "S级复核: check-then-write 命中 cart_service.go:41"] }
compatibility: { decision: include, depth: light, signals: ["有前端"] }
accessibility: { decision: include, depth: light, signals: ["有前端"] }
visual: { decision: include, depth: light, signals: ["有前端"] }
i18n: { decision: exclude, rationale: "需求信号(海外/多语言/RTL)未命中;无代码仓库", scanned: ["需求信号(G)"] }
migration: { decision: include, depth: standard, signals: ["migrations/2026-08-x.sql"] }
contract_integration: { decision: include, depth: standard, signals: ["外部风控依赖"] }
depth_budget: # full ≤3(两域合并计);被裁 Critical 轴走预算裁决
full_axes: [functional, permission, performance]
ranking_rationale: "R3(资损 Critical) > R2(越权 High) > ..."
automation_plan: # 哪些用例自动化、用什么框架(提案,⏸ 等用户确认)
regression_plan: # 回归策略(锚点用例、回归节奏)
risk_map_ref: # 指向 Risk Map(本文档内嵌,每条风险含证据)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -9 tokens per session 1c671c176f58
- 4d ago Changed e2f6e5b6a17a
- 8d ago First seen · 135 lines · 103 tokens per session scan A 330bfac558da
test-strategy is a skill published in the GitHub repository fishzjp/qa-skills (25 stars, last pushed today), licensed MIT. It adds 94 tokens to every session and 3,840 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
qa-expert
Expert-level quality assurance, testing strategies, automation, and QA processes. Use when the user mentions testing, test automation, quality assurance, or Selenium, or when the task involves Testing Types, QA Processes, Test Strategy, or Defect Management.
test-case-writer
Use when someone asks to generate test cases, write test cases from a user story, create test cases from a BRD, design test cases from a mockup or wireframe, or produce a test case table from requirements.
test-review
A review checklist for newly written or changed automated tests using TypeScript and Playwright. Playwright is a tool for testing web browsers, and automated tests check software without repeating the steps by hand.
playwright-expert
Expert in Playwright E2E testing framework, auto-waiting mechanisms, test generation, trace viewer, and CI/CD integration. Use when the user mentions testing, end-to-end tests, QA, automation, end-to-end testing, or test automation, or when the task involves Playwright Framework, Test Organization, Advanced Features…
selenium-expert
Expert in Selenium WebDriver, Selenium Grid, page object model, waits, cross-browser testing, and test automation frameworks. Use when the user mentions testing, end-to-end tests, QA, automation, WebDriver, or Selenium grid, or when the task involves Selenium Components, Browser Support, Advanced Features, or Basic…
testing
A thorough testing framework for websites, user interfaces, back-end services, APIs, and builds. It checks normal use, errors, limits, and unusual combinations, and records evidence for each result.