Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add guoliang1114-boop/AriaAI --skill walkthrough-and-control-testinggit clone --depth 1 https://github.com/guoliang1114-boop/AriaAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/guoliang1114-boop/ariaai/walkthrough-and-control-testing)<a href="https://agentmods.dev/skills/guoliang1114-boop/ariaai/walkthrough-and-control-testing"><img src="https://agentmods.dev/badge/skills/guoliang1114-boop/ariaai/walkthrough-and-control-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/guoliang1114-boop/ariaai/walkthrough-and-control-testing"><img src="https://agentmods.dev/badge/skills/guoliang1114-boop/ariaai/walkthrough-and-control-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.03519 |
| Opus 5 | $0.00017 | $0.01759 |
| Sonnet 5 | $0.00007 | $0.00704 |
| Haiku 4.5 | $0.00003 | $0.00352 |
Grade A, and why
walkthrough-and-control-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
穿行测试与控制测试
When To Use
- 年度审计中需要了解并测试客户内部控制流程时
- 识别关键控制点并评估其设计有效性和运行有效性时
- 客户流程发生重大变更需要重新穿行时
- SOX合规审计中对财务报告相关控制进行测试时
- 需要评估控制缺陷（重大缺陷/重要缺陷/一般缺陷）时
Tools
write- 创建控制测试工作底稿read- 审阅客户流程文档、制度文件grep- 搜索现有审计底稿中的控制描述glob- 查找相关审计文件bash- 运行抽样计算脚本
Framework
COSO 2013 Internal Control — Integrated Framework
五要素 (Five Components):
- Control Environment（控制环境） — 组织的基调，影响员工的控制意识
- Principle 1-5: 诚信与道德价值观、治理层监督、组织架构、胜任能力、问责制
- Risk Assessment（风险评估） — 识别和分析实现目标相关的风险
- Principle 6-9: 制定清晰目标、识别和分析风险、评估舞弊风险、识别重大变更
- Control Activities（控制活动） — 确保管理层指令得以执行的政策和程序
- Principle 10-12: 选择和开发控制活动、选择和开发IT控制、通过政策和程序部署
- Information & Communication（信息与沟通） — 获取和交换信息以支持内部控制
- Principle 13-15: 使用相关信息、内部沟通、外部沟通
- Monitoring Activities（监控活动） — 对内部控制进行持续评估和单独评估
- Principle 16-17: 持续和/或单独评估、沟通缺陷
穿行测试方法论 (Walkthrough Procedures)
参照 ISA 315 (Revised 2019) §15-18 及 PCAOB AS 2201:
- 选择单笔交易 — 选取一笔代表性交易从开始到结束追踪全流程
- 识别控制点 — 在每个关键处理步骤识别预防性或检查性控制
- 验证控制设计 — 评估控制是否能有效防止或发现重大错报
- 确认信息流 — 验证交易在各系统和部门间的流转逻辑
- 文档化 — 记录流程图、风险控制矩阵（RCM）
控制测试方法论 (Test of Controls)
参照 ISA 330 §12-15 及 PCAOB AS 2201 §42-46:
设计有效性测试 (Design Effectiveness):
- 控制是否针对已识别风险设计
- 控制执行人是否具备适当权限和胜任能力
- 控制执行频率是否足以及时防止或发现错报
运行有效性测试 (Operating Effectiveness):
- 控制是否在测试期间一贯执行
- 控制是否由适当人员执行
- 控制执行是否有充分证据支持
抽样方法 (Sampling)
参照 ISA 530 及 AICPA Audit Sampling Guide:
| 测试类型 | 推荐样本量 (中等控制频率) | 说明 |
|---|---|---|
| 年度1次 | 1 | 测试该笔交易 |
| 季度4次 | 2-4 | 每季度至少1笔 |
| 月度12次 | 5-15 | 考虑使用间隔抽样 |
| 周度52次 | 15-25 | 随机或系统抽样 |
| 日度250+ | 25-40 | 分层抽样 |
| 大量/自动化 | 1-25+ITGC | 依赖ITGC有效性 |
偏差率容忍度:
- 0偏差: 样本量=计划样本量，无偏差可接受
- 1偏差: 评估偏差性质，可能需要扩大样本
- 2+偏差: 通常表明控制无效，评估对审计策略的影响
Workflow
Step 1: 了解和记录流程
- 获取客户制度文件、流程描述
- 与客户流程负责人进行访谈
- 绘制流程图或编制流程描述文字
- 识别流程中的关键控制点
Step 2: 识别风险和控制
- 列出流程中的主要风险（错报风险、舞弊风险、合规风险）
- 将风险映射到认定（存在/完整性/准确性/截止/分类/计价）
- 识别每个风险对应的控制（预防性/检查性）
- 编制风险控制矩阵（RCM）
Step 3: 执行穿行测试
- 选择一笔代表性交易
- 从交易发起到最终记录，逐步追踪
- 在每个控制点验证控制设计
- 记录穿行过程中观察到的任何设计缺陷
- 更新流程图和RCM
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 295 lines · 34 tokens per session scan A f311a4206803
walkthrough-and-control-testing is a skill published in the GitHub repository guoliang1114-boop/AriaAI (37 stars, last pushed 4d ago), licensed MIT. It adds 34 tokens to every session and 3,519 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
domain_aml
Guidance for monitoring cross-border payments for money laundering and sanctions risks. It explains terms such as suspicious transactions and watchlists, which can include sanctioned people or politically exposed persons.
domain_ecommerce
Background guidance for working on cross-border online shops, including product classification, service commitments, pricing, taxes, data transfers, and consumer protection.
vibe-legal-batch-redliner
Use when you need to batch redline multiple contracts against a negotiation playbook, apply tracked changes to Word documents programmatically, or run contract review workflows with AI assistance.
legal_contract_expert
A contract-writing and contract-review specialist for agreements, clauses, and other legal documents. It checks required terms, balanced duties, and common legal risks.
generate_fillable_contract_html
Chinese HTML templates for contracts, quotations, and authorization letters with blank fields for later completion or DOCX conversion.
patentradar
A patent-infringement and competitor-analysis skill for patents identified by publication numbers such as CN, US, EP, or JP numbers.