Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HigorAlves/orc --skill evidence-publishgit clone --depth 1 https://github.com/HigorAlves/orcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/higoralves/orc/evidence-publish)<a href="https://agentmods.dev/skills/higoralves/orc/evidence-publish"><img src="https://agentmods.dev/badge/skills/higoralves/orc/evidence-publish/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/higoralves/orc/evidence-publish"><img src="https://agentmods.dev/badge/skills/higoralves/orc/evidence-publish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01273 |
| Opus 5 | $0.00024 | $0.00636 |
| Sonnet 5 | $0.00010 | $0.00255 |
| Haiku 4.5 | $0.00005 | $0.00127 |
Grade A, and why
evidence-publish scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **attach** available iff comment is available **and** `command -v curl` **and** a token env is set (`JIRA_API_TOKEN` or `ATLASSIAN_API_TOKEN`). Site + email are read from `acli jira auth status`; acli deliberately neve How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Evidence Publishing
Take the evidence packet browser QA already wrote to .orc/<branch>/files/qa/ and deliver it: attach the visual proof and post a summary to the linked ticket, or keep it local — always the user's explicit choice, and always safe to run (no tracker ⇒ local-only, no prompt, no error).
Announce at start: "I'm using the evidence-publish skill to deliver the QA evidence."
Collection is NOT this skill's job — /orc:qa (Driver A agent-browser / Driver B Claude-in-Chrome) already produced the packet. This skill owns delivery only: detect → curate → preview-gate → deliver → record.
Inputs
qaDir— the packet directory (.orc/<branch>/files/qa/or.orc/evidence/<KEY>/).ticketKey(optional) — an explicit key; else resolved from the active session.verdict—pass|fail|partialfrom the QA run (used in the comment).
Protocol
1. Detect — tracker enablement ladder
Two capability tiers, checked and degraded independently:
- comment available iff
command -v acliandacli jira auth statusexits 0. - attach available iff comment is available and
command -v curland a token env is set (JIRA_API_TOKENorATLASSIAN_API_TOKEN). Site + email are read fromacli jira auth status; acli deliberately never exposes its stored token, so REST upload needs the user's own.
Resolve the ticket: explicit ticketKey, else the active session's jiraTicket in .orc/orc.json (sanitized-branch match, status == in_progress) — the same resolution /orc:jira bind uses. No ticket, or comment unavailable ⇒ local-only (skip to step 5, no gate).
Exact commands: references/jira-adapter.md. The tracker-agnostic interface (to add GitHub/Linear later): references/adapter-contract.md.
2. Curate the payload
Prefer the manifest. When qaDir/qa-manifest.json exists, its curated array IS the payload — the driver already picked the items that best prove the behavior; take them verbatim and add steps.md. Also read its acceptance rows: the comment body names each criterion and its result, so the ticket says what was proven rather than "QA passed".
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 85 lines · 49 tokens per session scan A f52e3c5088e2
evidence-publish is a skill published in the GitHub repository HigorAlves/orc (6 stars, last pushed 15d ago), licensed MIT. It adds 49 tokens to every session and 1,273 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
flow-next-qa
Live-app QA pass derived from the spec. Drives the running app, files P0/P1/P2 findings with evidence, emits a YES or NO qaverdict receipt.
modernize-test-starter
Modernize QUnit unit tests and OPA5 integration tests to the UI5 Test Starter concept. Use this skill when: The linter reports prefer-test-starter for .qunit.html or .qunit.js files Test HTML files use manual sap-ui-core.js bootstrapping instead of Test Starter's runTest.js/createSuite.js Test JS files use…
qp
QP (Quality Platform) router — takes a web URL or a desktop app name and runs the plan → run → regress loop (qp-plan, qp-run, qp-regress) end to end, or routes to one stage. Classifies the target (public vs profile-required), probes which adapter the session has (Playwright MCP for web, computer-use MCP for desktop)…
qp-plan
Prepare stage of QP — builds a surface inventory of a web page or desktop app (routes, menus, forms, dialogs), checks it is MECE (no overlap, nothing missing that is visible), and designs test cases as a TSV with preconditions and expected values whose SOURCE is named. Works without a spec document (then expected…
qp-run
Automation stage of QP — executes the test cases from qp-plan against the live app through the session's adapter (Playwright MCP for web, computer-use MCP for desktop), records one verdict per step with a closed status, an MTM branch, whether the step was closed by machine evidence or left to judgment, and masks…
ui5-best-practices-opa5
This skill should be used in any OPA5 task - creating, modifying, extending, debugging, fixing or reviewing an integration test. Use when the user asks to "write an OPA5 test", "add an OPA5 journey", "fix the OPA5 test failure" or mentions OPA5 or its components - opaTest, page object, journey, waitFor.