Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add guoliang1114-boop/AriaAI --skill itgc-testinggit clone --depth 1 https://github.com/guoliang1114-boop/AriaAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/guoliang1114-boop/ariaai/itgc-testing)<a href="https://agentmods.dev/skills/guoliang1114-boop/ariaai/itgc-testing"><img src="https://agentmods.dev/badge/skills/guoliang1114-boop/ariaai/itgc-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/guoliang1114-boop/ariaai/itgc-testing"><img src="https://agentmods.dev/badge/skills/guoliang1114-boop/ariaai/itgc-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.04012 |
| Opus 5 | $0.00017 | $0.02006 |
| Sonnet 5 | $0.00007 | $0.00802 |
| Haiku 4.5 | $0.00003 | $0.00401 |
Grade A, and why
itgc-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 357 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IT一般控制测试 (ITGC Testing)
When To Use
- 审计中依赖信息系统生成的报告或数据时，需要测试ITGC
- SOX合规审计中IT系统支持财务报告流程时
- 客户引入新系统或现有系统发生重大变更时
- 需要评估自动化控制所依赖的IT环境可靠性时
- 客户IT治理和风险管理需要评估时
Tools
write- 创建ITGC测试矩阵和工作底稿read- 审阅IT政策、系统配置文档、用户权限清单grep- 搜索系统日志、变更记录bash- 执行权限分析脚本、日志比对
Framework
COBIT 2019 Framework References
ITGC四大领域与COBIT治理/管理目标的映射:
1. 访问控制 (Access to Programs and Data)
- DSS05: Managed Security Services
- DSS06: Managed Business Process Controls
- 关注: 用户账号管理、权限分配、认证机制、特权账号、定期权限复核
2. 变更管理 (Program Change Management)
- BAI06: Managed IT Changes
- BAI07: Managed IT Change Acceptance and Transitioning
- 关注: 变更请求、审批、开发、测试、上线、紧急变更
3. 系统开发 (Program Development)
- BAI02: Managed Requirements Definition
- BAI03: Managed Solutions Identification and Build
- BAI04: Managed Solution Availability
- BAI05: Managed Organizational Change
- BAI11: Managed Projects
- 关注: 需求定义、开发流程、用户验收测试、上线审批、数据迁移
4. IT运维 (Computer Operations)
- DSS01: Managed Operations
- DSS02: Managed Service Requests and Incidents
- DSS03: Managed Problems
- DSS04: Managed Continuity
- APO12: Managed Risk
- 关注: 作业调度、备份恢复、事件管理、批处理监控、灾难恢复
ISO 27001:2022 参考
ITGC测试亦可参考ISO 27001 Annex A控制项:
- A.5: Organizational controls (安全策略、职责分离)
- A.6: People controls (安全意识、入职离职)
- A.7: Physical controls (机房安全)
- A.8: Technological controls (访问控制、加密、变更管理)
SOX/PCAOB相关要求
参照PCAOB AS 2201 §36-38及IT Audit Guidance:
- 当审计师依赖系统生成的信息时，需要测试ITGC
- ITGC有效性是自动化控制可信赖的前提条件
- 需要评估ITGC对应用层面控制的影响
Workflow
Step 1: IT环境了解
- 识别支持财务报告的关键IT系统
- 了解系统架构（本地部署/云端/混合）
- 确定系统所有者和IT负责人
- 获取IT组织架构和职责分工
- 了解IT外包情况（如适用）
Step 2: ITGC范围界定
- 列出所有相关IT系统及组件
- 评估各系统对财务报告的重要性
- 确定需要测试的系统范围
- 识别各系统适用的ITGC领域
- 评估第三方服务商ITGC（SOC报告审阅）
Step 3: 控制识别与穿行
- 获取IT政策和程序文档
- 访谈IT管理层和关键人员
- 识别各领域的关键控制点
- 执行穿行测试验证控制设计
- 编制ITGC风险控制矩阵
Step 4: 控制测试执行
- 根据控制频率确定样本量
- 获取测试证据（配置截图、日志、审批记录）
- 执行测试并记录结果
- 对发现的偏差进行调查
- 评估控制缺陷等级
Step 5: 汇总与评估
- 汇总各系统/各领域测试结果
- 评估ITGC总体有效性
- 确定对应用层面控制和实质性程序的影响
- 编制ITGC测试报告
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 357 lines · 34 tokens per session scan A 383aebfeb54d
itgc-testing is a skill published in the GitHub repository guoliang1114-boop/AriaAI (37 stars, last pushed today), licensed MIT. It adds 34 tokens to every session and 4,012 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pytest-suite
Write or extend the backend test suite following this project's conventions. Use when adding tests for a new service/route/repository, when coverage is missing, or when asked to test a feature. Knows the mocked-session + httpx AsyncClient setup so tests run with no database.
uat-testing
Run end-to-end User Acceptance Tests for Agent Brain features. Builds wheels, installs packages, starts a test server, runs tests, and reports results — all without permission prompts.
debug
Structured bug diagnosis and fixing workflow that reproduces, diagnoses root cause, applies a minimal fix, writes regression tests, and scans for similar patterns.
gsd-verify-work
Validate built features through conversational UAT.
gsd-add-tests
Generate tests for a completed phase based on UAT criteria and implementation.
gsd-audit-uat
Cross-phase audit of all outstanding UAT and verification items.