Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-bug-lifecyclegit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-bug-lifecycle)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-bug-lifecycle"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-bug-lifecycle.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.02766 |
| Opus 5 | $0.00053 | $0.01383 |
| Sonnet 5 | $0.00021 | $0.00553 |
| Haiku 4.5 | $0.00011 | $0.00277 |
Grade A, and why
qa-bug-lifecycle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告:本技能的示例可能涉及订单号、支付金额、截图、身份证、手机号等敏感数据。 实际使用时请勿粘贴真实生产数据、客户信息或财务凭证;测试前应脱敏/掩码处理。 本技能仅在 workspace/ 输出评估文件,不持久化、不外传、不跨会话复用。
缺陷生命周期管理
核心原则
缺陷管理不仅仅是记录Bug,而是驱动问题解决和质量改进。
缺陷生命周期
状态流转
发现 → 确认 → 分配 → 修复 → 验证 → 关闭
│ │ │ │ │ │
│ │ │ │ │ └─ 关闭:验证通过
│ │ │ │ └─ 验证失败:重新打开
│ │ │ └─ 修复完成:等待验证
│ │ └─ 分配给开发:等待修复
│ └─ 确认为Bug:确认问题存在
└─ 测试发现:提交Bug报告
特殊状态:
├─ 拒绝:不是Bug/无法复现/设计如此
├─ 延期:当前版本不修复
├─ 重新打开:验证失败/回归失败
└─ 无法修复:技术限制/成本过高
状态定义
| 状态 | 定义 | 负责人 | 操作 |
|---|---|---|---|
| 新建 | 测试提交Bug | 测试 | 提交Bug |
| 确认 | 确认是Bug | 测试/开发 | 确认/拒绝 |
| 分配 | 分配给开发 | 测试/开发 | 分配 |
| 修复中 | 开发修复中 | 开发 | 修复 |
| 待验证 | 修复完成等待验证 | 测试 | 验证 |
| 已关闭 | 验证通过 | 测试 | 关闭 |
| 重新打开 | 验证失败 | 测试 | 重新打开 |
| 拒绝 | 不是Bug | 测试/开发 | 拒绝 |
| 延期 | 当前不修复 | 测试/开发 | 延期 |
缺陷分级
严重程度分级
P0-致命(Critical):
├─ 系统崩溃/数据丢失
├─ 核心功能完全不可用
├─ 安全漏洞
└─ 处理:立即修复
P1-严重(Major):
├─ 核心功能异常
├─ 数据错误
├─ 性能严重下降
└─ 处理:本版本修复
P2-一般(Normal):
├─ 次要功能异常
├─ 界面显示问题
├─ 操作不便
└─ 处理:下版本修复
P3-轻微(Minor):
├─ 文案错误
├─ 界面美化
├─ 优化建议
└─ 处理:排期修复
优先级定义
紧急(Urgent):
├─ 影响线上用户
├─ 阻塞测试/发布
└─ 处理:立即处理
高(High):
├─ 影响核心功能
├─ 本版本必须修复
└─ 处理:优先处理
中(Medium):
├─ 影响次要功能
├─ 尽量本版本修复
└─ 处理:正常处理
低(Low):
├─ 影响较小
├─ 可以延期处理
└─ 处理:排期处理
缺陷分析
缺陷类型分析
缺陷类型:
├─ 功能缺陷:功能不符合需求
├─ 界面缺陷:UI显示问题
├─ 性能缺陷:性能不达标
├─ 安全缺陷:安全漏洞
├─ 兼容性缺陷:兼容性问题
├─ 接口缺陷:接口问题
├─ 数据缺陷:数据问题
└─ 配置缺陷:配置问题
分析维度:
├─ 缺陷类型分布
├─ 缺陷模块分布
├─ 缺陷趋势
└─ 缺陷密度
缺陷根因分析
根因分类:
├─ 需求问题
│ ├─ 需求不清晰
│ ├─ 需求变更
│ └─ 需求遗漏
│
├─ 设计问题
│ ├─ 设计不合理
│ ├─ 设计遗漏
│ └─ 设计变更
│
├─ 实现问题
│ ├─ 代码错误
│ ├─ 逻辑错误
│ └─ 边界处理
│
├─ 环境问题
│ ├─ 环境配置
│ ├─ 依赖问题
│ └─ 数据问题
│
└─ 测试问题
├─ 用例遗漏
├─ 执行遗漏
└─ 验证不充分
缺陷度量指标
核心指标:
├─ 缺陷密度 = 缺陷数 / 功能点数
├─ 缺陷修复率 = 已修复缺陷 / 总缺陷
├─ 缺陷重开率 = 重新打开缺陷 / 总缺陷
├─ 缺陷逃逸率 = 线上缺陷 / (线上+测试缺陷)
└─ 缺陷修复周期 = 修复日期 - 提交日期
分析维度:
├─ 按时间:缺陷趋势
├─ 按模块:模块质量
├─ 按类型:问题分布
└─ 按人员:效率分析
缺陷报告模板
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed cf1d28b386a8
- 8d ago First seen · 295 lines · 105 tokens per session scan A 7d586423d478
qa-bug-lifecycle is a skill published in the GitHub repository Kokxi/qa-test-skills (24 stars, last pushed 5d ago), licensed MIT. It adds 105 tokens to every session and 2,766 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.
react-development
React 19+ with TypeScript — hooks, custom hooks, state management (useState/useReducer/useContext), React Query/SWR, Tailwind CSS, performance. Use when building React components, apps, or optimizing renders.
javascript-development
JavaScript/TypeScript ES2024+, async/await, DOM manipulation, Node.js, and API integration. Use when writing vanilla JS/TS code, working with REST/fetch APIs, implementing frontend logic, or configuring JS build tools.
nextjs-development
Next.js 16.2.4 with TypeScript — App Router, Server Components, use cache directive, Turbopack dev, Server Actions, ISR, SSR, SSG, MCP devtools, metadata API, route handlers, instrumentation.
php-development
PHP 8.0+ development — XAMPP, RESTful APIs, PDO/MySQL/MariaDB, and authentication. Use when building PHP backends, creating API endpoints, configuring XAMPP, or integrating PHP with databases.
tdd-cycle
Red-Green-Refactor test-driven development cycle.