Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-boundary-deep-divegit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-boundary-deep-dive)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-boundary-deep-dive"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-boundary-deep-dive/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-boundary-deep-dive"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-boundary-deep-dive.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.03395 |
| Opus 5 | $0.00076 | $0.01698 |
| Sonnet 5 | $0.00030 | $0.00679 |
| Haiku 4.5 | $0.00015 | $0.00340 |
Grade A, and why
qa-boundary-deep-dive scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 311 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及订单号、支付金额、截图、身份证、手机号等敏感数据。 实际使用时请勿粘贴真实生产数据、客户信息或财务凭证；测试前应脱敏/掩码处理。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
边界深度分析
核心原则
真正的Bug往往在"看起来不是边界"的地方——从输入、状态、时间、资源四个维度系统识别边界条件。标注风险等级并给出明确的预期结果。
边界数量要求（参考值）
关键指标：根据项目复杂度调整
| 复杂度 | 倍数 | 示例（场景25个） |
|---|---|---|
| 简单项目 | ×1.5 | 边界38个 |
| 中等项目 | ×2 | 边界50个 |
| 复杂项目 | ×2.5 | 边界63个 |
复杂度判断标准：
- 简单：单模块、低风险、无并发
- 中等：多模块、中风险、少量并发
- 复杂：跨模块、高风险、高并发
四维边界模型
维度1：输入边界
最容易发现，但也最容易遗漏细节
输入边界清单：
├─ 值域边界
│ ├─ 最小值：0、1、-1、最小负数
│ ├─ 最大值：最大正数、最大长度
│ ├─ 空值：null、空字符串、空格
│ └─ 特殊值：0、负数、小数、科学计数法
│
├─ 格式边界
│ ├─ 编码：UTF-8、GBK、特殊字符
│ ├─ 长度：超长、刚好、为0
│ ├─ 类型：数字、字母、中文、混合
│ └─ 格式：日期、邮箱、手机号、URL
│
├─ 组合边界
│ ├─ 多字段：字段间依赖关系
│ ├─ 批量：批量输入的边界
│ └─ 并发：并发输入的边界
│
└─ 业务边界
├─ 唯一性：重复数据
├─ 关联性：外键不存在
└─ 有效性：数据过期
示例（金额输入）：
值域边界：
- 0元：能否购买？
- 0.01元：最小金额？
- 99999999.99元：最大金额？
- 负数：能否退款？
- 小数位：0.1元、0.01元、0.001元（精度丢失）
格式边界：
- 非数字：abc
- 特殊字符：$100、100元
- 科学计数法：1e10
维度2：状态边界
状态转换的临界点
状态边界清单：
├─ 状态转换边界
│ ├─ 合法转换：正常路径
│ ├─ 非法转换：不允许的操作
│ ├─ 临界转换：刚好满足条件
│ └─ 并发转换：同时触发多个转换
│
├─ 状态值边界
│ ├─ 初始状态：对象创建时
│ ├─ 终态：对象生命周期结束
│ ├─ 中间状态：处理过程中
│ └─ 异常状态：错误/超时
│
└─ 状态持续边界
├─ 最短持续：状态保持的最短时间
├─ 最长持续：状态保持的最长时间
└─ 超时处理：超过时间限制怎么办
示例（订单状态）：
合法转换：
- 待支付 → 已支付（正常）
- 待支付 → 已取消（超时）
非法转换：
- 已完成 → 已支付（不允许）
- 已取消 → 待支付（不允许）
临界转换：
- 支付刚好在超时前1秒完成
- 库存刚好剩1件时下单
并发转换：
- 同一订单同时支付和取消
维度3：时间边界
超时、并发、时序相关
时间边界清单：
├─ 超时边界
│ ├─ 请求超时：接口响应时间
│ ├─ 连接超时：建立连接时间
│ ├─ 会话超时：用户登录状态
│ └─ 业务超时：订单支付时间
│
├─ 并发边界
│ ├─ 同时操作：多用户同时操作同一数据
│ ├─ 重复提交：用户重复点击
│ ├─ 竞态条件：操作顺序影响结果
│ └─ 资源竞争：多个操作竞争同一资源
│
├─ 时序边界
│ ├─ 操作顺序：A必须在B之前
│ ├─ 依赖关系：A的结果影响B
│ ├─ 中间状态：操作过程中的状态
│ └─ 原子性：操作是否不可分割
│
└─ 周期边界
├─ 日切：每天0点的数据处理
├─ 月切：每月1号的结算
├─ 年切：年度数据归档
└─ 节假日：特殊日期的处理
示例（支付超时）：
超时边界：
- 支付超时：30分钟
- 网络超时：30秒
- 重试超时：3次重试
并发边界：
- 同一用户多设备支付
- 多人同时购买最后一件商品
时序边界：
- 支付回调先于支付请求到达
- 支付成功但库存扣减失败
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 350a56f1d6cf
- 11d ago First seen · 311 lines · 151 tokens per session scan A 2f37b216068a
qa-boundary-deep-dive is a skill published in the GitHub repository Kokxi/qa-test-skills (25 stars, last pushed 9d ago), licensed MIT. It adds 151 tokens to every session and 3,395 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
swarm-advanced
Advanced swarm orchestration patterns for research, development, testing, and complex distributed workflows.
code-review
Reviews Spec Kit code changes for positive and negative test coverage, regression evidence for bug fixes, and consistent repository terminology. Use when reviewing a diff or pull request. Do not use for implementing changes or posting GitHub review actions.
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…
octocode-graph-eval
Use when you need a measurable keep/discard loop — goal→KPI, baseline vs target, held-out checks, eval suites, or don't-stop-till-done against a runnable sensor. Not for ordinary ship checks where 'tests passed' is enough.