Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kimsanguine/hplan --skill qa-checklistgit clone --depth 1 https://github.com/kimsanguine/hplanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kimsanguine/hplan/qa-checklist)<a href="https://agentmods.dev/skills/kimsanguine/hplan/qa-checklist"><img src="https://agentmods.dev/badge/skills/kimsanguine/hplan/qa-checklist.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.05277 |
| Opus 5 | $0.00034 | $0.02638 |
| Sonnet 5 | $0.00014 | $0.01055 |
| Haiku 4.5 | $0.00007 | $0.00528 |
Grade A, and why
qa-checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 424 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Core Goal
docs/PRD.md의 ICP·성공 지표·실패 시나리오 섹션을 파싱해
harness/QA_CHECKLIST.md를 자동 생성한다.
| 모드 | 동작 |
|---|---|
--append (기본값) |
기존 TC 유지, 새로 생성된 TC만 추가, 중복 제거 |
--regenerate |
기존 파일 덮어쓰기 |
--mode adversarial |
QA 라운드 — harness/PERSONA_SPECS.json + harness/QA_POOL.json을 읽어 페르소나·개발 에이전트를 동적 구성. CRITICAL/HIGH 발견 시 ralph loop 자동 수정. 라운드별 harness/qa-rounds/round-N.md + harness/qa_log.jsonl 기록. |
심각도 체계 구분: 일반 모드(
--append/--regenerate)는critical/major/minor3등급.--mode adversarial은CRITICAL/HIGH/MEDIUM/MINOR4등급. 두 체계는 독립이며 결과물도 별도 — 일반:harness/QA_CHECKLIST.md/ adversarial:harness/qa-rounds/round-N.md.
Rule 5 준수 — 심각도 분류는 명시적 기준으로 결정
| 판단 | 도구 | LLM |
|---|---|---|
| PRD 섹션 존재 여부 | grep/Read | ❌ |
| ICP 조건 목록 추출 | 텍스트 파싱 | ✅ (비정형 추출) |
| 실패 시나리오 목록 추출 | 텍스트 파싱 | ✅ (비정형 추출) |
| 심각도 분류 | 아래 명시된 기준 + LLM | ✅ |
| 디바이스/환경 판단 | PRD 플랫폼 키워드 → 결정론 매핑 | ❌ |
| TC-ID 번호 부여 | 순번 증가 | ❌ |
| PRD 섹션 커버리지 집계 | 파일 존재 여부 | ❌ |
심각도 분류 기준
- critical: ICP가 이 시나리오 없이 핵심 목표를 달성 못 함 (결제, 회원가입, 핵심 기능 등)
- major: 대체 경로 존재하지만 현저히 불편하거나 ICP의 20% 이상에 영향
- minor: 엣지 케이스, 특수 환경, 브랜드 영향 낮음
디바이스/환경 판단 로직
PRD에 명시된 타겟 플랫폼 기준:
| PRD 키워드 | 포함 환경 |
|---|---|
| Web app / 웹앱 | Chrome Desktop, Safari Mobile |
| Mobile app / 모바일앱 | iOS 최신+1, Android 최신+1 |
| API / CLI | 해당 런타임 환경 |
| 미명시 | 모든 주요 브라우저 |
Trigger Gate
Use This Skill When
- deliver 완료 후, QA 체크리스트 작성 전
harness-build --step quality-gate실행 전- PRD가 업데이트되어 TC 재생성이 필요할 때
- 배포 전 최종 QA 라운드 —
--mode adversarial:harness/QA_POOL.json이 존재하고 실 사용자 페르소나 + 개발 리뷰어 관점 검수가 필요할 때
Route to Other Skills When
- UI 런타임 검증 →
deliver/ui-validate - ship 직전 전체 게이트 →
deliver/respect --mode checkpoint - PRD 작성 (§15 QA Pool 포함) →
deliver/prd - 페르소나 구성 →
hplan/interview-synthesis(PERSONA_SPECS.json 생성)
Boundary Checks
docs/PRD.md부재 → fail loud + "docs/PRD.md 없음./harness-build --step prd또는/prd(deliver 스킬, §15 QA Pool 포함) 먼저 실행하세요."- Section 1(ICP) 부재 → fail loud + "PRD §1 ICP 섹션이 필요합니다."
harness/디렉터리 부재 →mkdir -p harness/후 진행--mode adversarial+harness/QA_POOL.json부재 → fail loud + "harness/QA_POOL.json 없음. /prd 실행 후 §15 QA Pool이 생성되어야 합니다."--mode adversarial+harness/PERSONA_SPECS.json부재 → WARN (FAIL 아님) + "페르소나 없이 개발 리뷰어만으로 진행합니다. interview-synthesis 완료 후 재실행을 권장합니다."--mode adversarial+harness/QA_POOL.json의dev_roles: []빈 배열 → fail loud + "dev_roles가 비어 있습니다. /prd 재실행하고 §15 QA Pool을 완성하세요."
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 424 lines · 69 tokens per session scan A 229be814c50f
qa-checklist is a skill published in the GitHub repository kimsanguine/hplan (2 stars, last pushed 22d ago), licensed MIT. It adds 69 tokens to every session and 5,277 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
feature-verify
Feature verification (READ-ONLY, P0-P5). Use when: verifying feature behavior after deployment, validating API responses, diagnosing production issues, post-deploy smoke test. Not for: modifying data (use feature-dev), code review (use codex-review-fast), writing tests (use codex-test-gen), security audit (use…
test-health
Holistic test coverage measurement. Use when: assessing test health, measuring coverage trends, quantitative + qualitative test audit. Not for: running tests (use verify), reviewing test sufficiency only (use codex-test-review), generating tests (use codex-test-gen). Output: multi-dimensional dashboard with coverage…
test-review
Test coverage review via Codex exec. Use when: reviewing test sufficiency, identifying coverage gaps, test quality audit. Not for: generating tests (use codex-test-gen), code review (use codex-code-review). Output: coverage analysis + gap report.
post-dev-test
Post-development test completion. Use when: checking test coverage after feature-dev, writing missing integration/e2e tests. Not for: unit test generation (use codex-test-gen), test review (use test-review). Output: test files + coverage report.
pre-pr-audit
Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…
precommit
Pre-commit checks — lint:fix -> build -> test.