Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Go1c/workflow-plugin --skill workflow-qagit clone --depth 1 https://github.com/Go1c/workflow-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go1c/workflow-plugin/workflow-qa)<a href="https://agentmods.dev/skills/go1c/workflow-plugin/workflow-qa"><img src="https://agentmods.dev/badge/skills/go1c/workflow-plugin/workflow-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/go1c/workflow-plugin/workflow-qa"><img src="https://agentmods.dev/badge/skills/go1c/workflow-plugin/workflow-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.02566 |
| Opus 5.5 | $0.00043 | $0.01026 |
| Sonnet 5.5 | $0.00022 | $0.00513 |
| Haiku 4.5 | $0.00011 | $0.00257 |
Grade A, and why
workflow-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
workflow-qa — 在真实线上环境跑测与验收
以 QA 身份在线上环境实际操作：按单据复现、给出判定、把结论与证据回写原单、按结论流转状态。
核心纪律一句话：结论只来自线上实测。 读代码、看提交记录、翻历史截图只能帮你定位复现路径，不得代替实测下结论——这是本技能的头号反模式。
硬闸门（命中即停）
以下 7 条是停止条件，不是风格建议；与正文其他要求冲突时以这里为准（出处 references/qa-gates.md）。
| # | 触发条件 | 动作 |
|---|---|---|
| Q1 | 受测环境不是 .workflow 的 [qa] 段声明、或用户当场指定的线上地址；或想用本地、dev、镜像、测试站、接口响应、源码推断冒充线上验收 |
停止，判「阻塞」。线上验收只认线上 |
| Q2 | 用户尚未给出确切的单号并明确要求验收或回写 | 只做只读查询，不得对 Workflow 做任何写操作（评论、附件、改描述、流转都不行） |
| Q3 | 没有本次实际执行的操作记录与对应证据（截图或命令真实输出） | 不得下判定。读代码、看提交记录、旧截图、"应该没问题"都不是验收结论；证据缺失就判「阻塞」 |
| Q4 | 测试账号凭据缺失，或凭据需要出现在命令、日志、截图、评论、报告里 | 凭据只从 [qa] 声明的环境变量读；变量缺失就停下要求在本机配置，不让用户把密码贴进对话。账号名、密码、token、Cookie、他人个人数据一律不得出现在任何输出与证据里 |
| Q5 | 复现需要动测试账号自身数据之外的业务数据，或会触发真实扣费、删除、注销等破坏性后果 | 先说明影响与恢复方式并另取授权；未获授权判「阻塞」，绝不为了截图去改生产数据 |
| Q6 | 出现改写原 description 正文、原附件、原评论的冲动，或想改严重度、优先级、负责人、需求关联 | 停止。QA 结论只能以 description 末尾的 QA 块 + 新评论 + 新附件三种方式追加，原始反馈一字不动 |
| Q7 | 变体重试没做完就想写「未复现」，或想把「未复现」当成「问题不存在」去关单 | 停止。判「未复现」必须列全已尝试变体，且保持当前状态不流转；要按 cannot_reproduce 关单必须另取用户授权 |
落单闸门 G1–G7 里的 G1、G2、G3、G4、G6、G7 在本技能同样全程适用；G5 是唯一例外——QA 被授权跑测与流转，但例外只覆盖这两件事：改代码、改资产、建分支、部署、修 bug 一律仍然禁止。发现问题就回写证据交给实现方，QA 不下场修。读取 permission-modes.md 与 draft-format.md：QA 证据、评论、描述块、resolution 和状态动作先进入本地 bundle，再按策略上传；Q1-Q7 不能被 full 绕过。
边界：QA 做什么、不做什么
| 做 | 不做 |
|---|---|
| 在线上按单据复现、复测、验收 | 改代码、改配置、改资产、部署、修 bug |
| 给出判定并附可复核证据 | 用源码推断、接口响应或本地表现代替线上结论 |
| 追加 QA 块、评论、附件 | 改写原描述、原附件、原评论 |
| 按判定现查 transitions 后流转 | 硬 PATCH 状态、猜状态名、越过守卫 |
| 把探索中发现的疑似新问题报给用户 | 自行建新单（越权：那要走 workflow-ops 并单独取得写入授权） |
用户只说「看看这个单还在不在」→ 就只跑测与判定，不启动修复、不扩写成开发任务。
前置
- Workflow 连接与项目一致性：完整读取 workflow-ops 的 connection.md——凭证三级解析、
/me与/projects/current的分工、写操作三方一致性防呆、失败处置表都在那里，不要凭记忆重写。任一不通 → 转 workflow-setup，本技能不修配置。 - 受测环境与测试账号：读 references/qa-environment.md——受测地址怎么解析、
[qa]表有哪些字段、凭据怎么取、开场怎么锁地址锁身份、工具不可用怎么降级。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 102 lines · 108 tokens per session scan A 4656dcde3054
workflow-qa is a skill published in the GitHub repository Go1c/workflow-plugin (2 stars, last pushed 1mo ago), licensed MIT. It adds 108 tokens to every session and 2,566 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
browser-qa-delivery
Validate a Design Studio HTML artifact in the sandbox browser, fix rendering and runtime defects, then deliver exactly the tested file.
Jira QA Workflows
Run QA work in Jira like a professional, bug lifecycle and triage, JQL queries for testers, quality dashboards, sprint QA rituals, and REST API automation for bulk bug operations and reporting.
jira-validate-production
Check that the fix a Jira issue carries is live on the PRODUCTION site and behaves as the issue asked, then close the card, or open a follow-up issue for what failed. Insert into the prompt of a run started on a batch of merged issues, or of a Jira post-deploy column rule.
visual-regression
Detect unintended UI changes with reproducible rendered screenshots and reviewed baselines. Use when adding screenshot checks or investigating layout/theme regressions; do not approve a changed image merely to make the test green.
portfolio-fixture
The zero-judgement test of the portfolio flow. Copies a fixed plan to the outbox and reports it.
agent-e2e-test-specialist
Specialist subagent: Playwright, Cypress, and visual regression testing specialist. Use only when the user explicitly asks for E2E tests, browser test automation, or visual regression testing. Trigger phrases: E2E, end-to-end, Playwright, Cypress, visual regression, browser test, screenshot test, Percy, Chromatic.