Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/heliohq/ship/qanpx skills add heliohq/ship --skill qagit clone --depth 1 https://github.com/heliohq/shipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heliohq/ship/qa)<a href="https://agentmods.dev/skills/heliohq/ship/qa"><img src="https://agentmods.dev/badge/skills/heliohq/ship/qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.01979 |
| Opus 5 | $0.00026 | $0.00989 |
| Sonnet 5 | $0.00010 | $0.00396 |
| Haiku 4.5 | $0.00005 | $0.00198 |
Grade A, and why
qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
(screenshot, curl response, command output). "Should work based on How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship: QA
You are an independent QA tester — the human-like exploratory sweep that runs AFTER the automated E2E suite is already green and review is clean. You interact with the running application, look for what the codified tests didn't catch, and report problems. You do not fix them.
What E2E already covered: deterministic pass/fail on the spec's acceptance criteria. If E2E is green, those specific flows work.
What you're looking for: everything else — UX confusion, visual regressions, perf smells, odd edge cases, unexpected interactions, "this just feels wrong". The things tests can't see.
Path note: ../shared/*.md references resolve against this skill's base
directory (announced as "Base directory for this skill" when the skill
loaded), not your working directory.
Flow
1. Understand Read spec + git diff to know WHAT changed and WHAT to test
2. Start Start the application (../shared/startup.md)
3. Test Test changes using the matching references
4. Cleanup Kill services you started
5. Report Summarize what you found
Red Flag
Never:
- Read
review.mdorplan.md— breaks independence. (spec.mdIS allowed — it defines the acceptance criteria you must verify.) - Accept HTTP 200, "E2E suite green", or "tests passed" as proof a feature works for the user. Those are baselines, not evidence — you must still interact with the running app and produce your own screenshots/outputs.
- Skip exploratory testing because "E2E covered it" — E2E runs the paths someone thought to write. Your job is the paths they didn't.
- Just re-run the E2E tests — they already passed. Your verdict must come from independent interaction.
Phase 1: Understand the changes
Read the spec and the diff. These two inputs decide everything.
# What changed? Use the base branch provided by caller, or detect it.
BASE=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||')
[ -z "$BASE" ] && BASE=$(git rev-parse --verify origin/main >/dev/null 2>&1 && echo main || echo master)
git diff "$BASE"...HEAD --stat
git diff "$BASE"...HEAD --name-only
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 225 lines · 51 tokens per session scan A 069f66372dec
qa is a skill published in the GitHub repository heliohq/ship (92 stars, last pushed 2mo ago), licensed MIT. It adds 51 tokens to every session and 1,979 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cesiumjs-3d-tiles
CesiumJS 3D Tiles - Cesium3DTileset, compressed and CAD-style glTF content, MVTDataProvider, styling, metadata, feature picking, voxels, point clouds, I3S, Gaussian splats, clipping. Use when loading 3D Tiles or Mapbox Vector Tiles, rendering KHR meshopt/CAD content, styling or querying features, working with voxels…
cesiumjs-camera
CesiumJS camera control - Camera, flyTo, lookAt, setView, ScreenSpaceCameraController, CameraEventAggregator, flight animation. Use when positioning the camera, creating flyTo animations, constraining user navigation, tracking entities, or converting between screen and world coordinates.
cesiumjs-custom-shader
CustomShader authoring — vertexShaderText and fragmentShaderText against VertexInput, FragmentInput, FeatureIds, Metadata, czmmodelMaterial. Use when reading EXTmeshfeatures or EXTstructuralmetadata property textures/tables, vertex displacement, or shading VoxelPrimitive.
cesiumjs-entities
CesiumJS entities and data sources - Entity, EntityCollection, DataSource, GeoJsonDataSource, KmlDataSource, CzmlDataSource, Graphics types, PathGraphics, PathMode, Visualizers. Use when adding points, labels, models, polygons, polylines, or time-segmented paths, loading GeoJSON/KML/CZML/GPX data, or working with the…
cesiumjs-imagery
CesiumJS imagery layers - ImageryProvider, ImageryLayer, ImageryLayerCollection, WMS, WMTS, Bing, OpenStreetMap, ArcGIS, Mapbox, tile discard policies. Use when adding or swapping base map layers, configuring imagery providers, layering multiple map sources, or creating split-screen imagery comparisons.
cesiumjs-time-properties
CesiumJS time, properties, and animation - Clock, JulianDate, TimeInterval, Property, SampledProperty, CallbackProperty, PathMode, interval and sampled path materials, interpolation, splines, CZML temporal data. Use when making entity attributes or path materials time-dynamic, configuring the simulation clock…