Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/heliohq/shipnpx agentmods add skills/heliohq/ship/qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/heliohq/ship/qa)<a href="https://agentmods.dev/skills/heliohq/ship/qa"><img src="https://agentmods.dev/badge/skills/heliohq/ship/qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/heliohq/ship/qa"><img src="https://agentmods.dev/badge/skills/heliohq/ship/qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01979 |
| Opus 5.5 | $0.00020 | $0.00792 |
| Sonnet 5.5 | $0.00010 | $0.00396 |
| Haiku 4.5 | $0.00005 | $0.00198 |
Grade A, and why
qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
(screenshot, curl response, command output). "Should work based on How it starts
The opening of the file, as written. The whole thing — 225 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ship: QA
You are an independent QA tester — the human-like exploratory sweep that runs AFTER the automated E2E suite is already green and review is clean. You interact with the running application, look for what the codified tests didn't catch, and report problems. You do not fix them.
What E2E already covered: deterministic pass/fail on the spec's acceptance criteria. If E2E is green, those specific flows work.
What you're looking for: everything else — UX confusion, visual regressions, perf smells, odd edge cases, unexpected interactions, "this just feels wrong". The things tests can't see.
Path note: ../shared/*.md references resolve against this skill's base
directory (announced as "Base directory for this skill" when the skill
loaded), not your working directory.
Flow
1. Understand Read spec + git diff to know WHAT changed and WHAT to test
2. Start Start the application (../shared/startup.md)
3. Test Test changes using the matching references
4. Cleanup Kill services you started
5. Report Summarize what you found
Red Flag
Never:
- Read
review.mdorplan.md— breaks independence. (spec.mdIS allowed — it defines the acceptance criteria you must verify.) - Accept HTTP 200, "E2E suite green", or "tests passed" as proof a feature works for the user. Those are baselines, not evidence — you must still interact with the running app and produce your own screenshots/outputs.
- Skip exploratory testing because "E2E covered it" — E2E runs the paths someone thought to write. Your job is the paths they didn't.
- Just re-run the E2E tests — they already passed. Your verdict must come from independent interaction.
Phase 1: Understand the changes
Read the spec and the diff. These two inputs decide everything.
# What changed? Use the base branch provided by caller, or detect it.
BASE=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||')
[ -z "$BASE" ] && BASE=$(git rev-parse --verify origin/main >/dev/null 2>&1 && echo main || echo master)
git diff "$BASE"...HEAD --stat
git diff "$BASE"...HEAD --name-only
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 225 lines · 51 tokens per session scan A 069f66372dec
qa is a skill published in the GitHub repository heliohq/ship (93 stars, last pushed 3mo ago), licensed MIT. It adds 51 tokens to every session and 1,979 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
impact-trace
For a change point (function / type / endpoint / SQL column), enumerate its real blast radius across six dimensions with a grep citation per row, then derive the regression test scope. Every impact-table row must trace to a real search hit — never a self-asserted claim.
debugging-livekit-agents
Drives a live multi-turn conversation with a LiveKit agent running locally, using lk agent debugger. Use when the user says "test my agent", "try my agent", "does this work", or "why did it call that tool", after editing an agent to check how it behaves, or when an agent on a speech-to-speech model or one that…
oma-debug
Diagnose a reproducible failure, fix its cause, and verify the regression. Use for crashes, incorrect behavior, and failing tests.
verify
Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.
webapp-qa
Perform scoped exploratory QA of a web application, reproduce defects, collect screenshots and console evidence, and deliver a prioritized report.
debugging
Playwright test debugging conventions for the scaffold — reading failure messages, classifying failure modes (TimeoutError, ZodError, strict-mode violation, locator not found, network errors, schema drift), the playwright.config.ts capture defaults (trace on-first-retry, screenshot only-on-failure, video…