Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-bug-reportinggit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-bug-reporting)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-bug-reporting"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-bug-reporting.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.02324 |
| Opus 5 | $0.00063 | $0.01162 |
| Sonnet 5 | $0.00025 | $0.00465 |
| Haiku 4.5 | $0.00013 | $0.00232 |
Grade A, and why
qa-bug-reporting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及订单号、支付金额、截图、身份证、手机号等敏感数据。 实际使用时请勿粘贴真实生产数据、客户信息或财务凭证；测试前应脱敏/掩码处理。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
Bug报告艺术
核心原则
好的Bug报告不只是"描述问题"，而是帮开发缩小排查范围。
Bug报告黄金结构
结构1：标题（是什么+在哪+什么条件下）
标题公式：
[功能模块] + [具体现象] + [触发条件]
好标题：
✓ [登录] 输入正确密码提示"密码错误"（Chrome浏览器）
✓ [支付] 支付成功后订单状态仍为"待支付"
✓ [导出] 导出Excel文件乱码（Windows系统）
坏标题：
✗ 登录有问题
✗ 支付报错了
✗ 导出不对
结构2：前置条件（测试前需要满足什么）
前置条件清单：
├─ 用户状态：登录/未登录、角色、权限
├─ 数据状态：测试数据准备
├─ 环境状态：浏览器、系统、网络
├─ 配置状态：功能开关、配置项
└─ 依赖状态：第三方服务状态
示例：
- 用户已登录，角色为普通用户
- 测试账号：testuser001
- 浏览器：Chrome 120.0
- 网络：正常网络环境
- 测试数据：已创建一个待支付订单
结构3：复现步骤（精确到每一步）
复现步骤格式：
1. [操作步骤1]
2. [操作步骤2]
3. [操作步骤3]
4. 观察[具体现象]
示例：
1. 打开登录页面
2. 输入用户名：testuser001
3. 输入密码：Test@1234
4. 点击"登录"按钮
5. 观察页面提示
注意：
- 每步只做一个操作
- 步骤要可重复
- 包含必要的输入数据
结构4：预期vs实际（明确对比）
预期结果：[应该发生什么]
实际结果：[实际发生了什么]
示例：
预期结果：登录成功，跳转到首页
实际结果：提示"密码错误"，停留在登录页面
结构5：附件（怎么截图、怎么抓包）
附件清单：
├─ 截图：错误界面截图
├─ 日志：控制台日志
├─ 网络：网络请求/响应
├─ 录屏：操作过程录制
└─ 环境：浏览器版本、系统信息
截图技巧：
- 截取完整错误信息
- 包含关键操作区域
- 标注问题位置
- 多个角度截图
抓包技巧：
- 使用Chrome DevTools
- 记录请求URL、参数、响应
- 标注异常请求
- 导出HAR文件
结构6：根因推测（如果有）
根因推测：
├─ 推测方向：可能是[代码/数据/配置]问题
├─ 推测依据：因为[日志/现象/经验]
├─ 验证建议：建议检查[具体位置]
示例：
推测方向：可能是密码验证逻辑问题
推测依据：控制台日志显示"password validation failed"
验证建议：建议检查LoginController.validatePassword方法
结构7：影响范围评估
影响评估：
├─ 影响功能：[具体功能]
├─ 影响用户：[用户范围]
├─ 影响程度：[严重/一般/轻微]
├─ 是否阻塞：[是否阻塞其他功能]
└─ 修复优先级：[P0/P1/P2/P3]
示例：
影响功能：用户登录功能
影响用户：所有用户
影响程度：严重（无法登录）
是否阻塞：是（阻塞所有需要登录的功能）
修复优先级：P0（紧急）
Bug报告模板
📌 本节与 qa-bug-lifecycle「缺陷报告模板」为同一概念的两个版本。本技能模板侧重执行（含前置条件、影响评估），lifecycle 模板侧重管理（含状态、优先级字段）。修改字段时请同步更新两个模板。
# Bug报告
## 基本信息
- Bug标题：[功能模块] + [具体现象] + [触发条件]
- 严重程度：P0/P1/P2/P3
- Bug类型：功能/性能/安全/UI/兼容性
- 发现版本：[版本号]
- 环境信息：[浏览器/系统/设备]
## 前置条件
1. [条件1]
2. [条件2]
3. [条件3]
## 复现步骤
1. [步骤1]
2. [步骤2]
3. [步骤3]
4. 观察[现象]
## 预期结果
[应该发生什么]
## 实际结果
[实际发生了什么]
## 附件
- 截图：[截图描述]
- 日志：[日志内容]
- 网络：[请求/响应]
## 根因推测（可选）
[可能是...因为...建议检查...]
## 影响评估
- 影响功能：[功能]
- 影响用户：[用户范围]
- 影响程度：[严重/一般/轻微]
- 修复优先级：[P0-P3]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed 2b7112b548a0
- 8d ago First seen · 262 lines · 127 tokens per session scan A 25f4018a2b7c
qa-bug-reporting is a skill published in the GitHub repository Kokxi/qa-test-skills (24 stars, last pushed 6d ago), licensed MIT. It adds 127 tokens to every session and 2,324 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.
javascript-development
JavaScript/TypeScript ES2024+, async/await, DOM manipulation, Node.js, and API integration. Use when writing vanilla JS/TS code, working with REST/fetch APIs, implementing frontend logic, or configuring JS build tools.
nextjs-development
Next.js 16.2.4 with TypeScript — App Router, Server Components, use cache directive, Turbopack dev, Server Actions, ISR, SSR, SSG, MCP devtools, metadata API, route handlers, instrumentation.
php-development
PHP 8.0+ development — XAMPP, RESTful APIs, PDO/MySQL/MariaDB, and authentication. Use when building PHP backends, creating API endpoints, configuring XAMPP, or integrating PHP with databases.
react-development
React 19+ with TypeScript — hooks, custom hooks, state management (useState/useReducer/useContext), React Query/SWR, Tailwind CSS, performance. Use when building React components, apps, or optimizing renders.
mongodb-mongoose
MongoDB with Mongoose — schemas, models, aggregation pipelines, migrations, and Atlas connections. Use when designing collections, writing queries, or integrating MongoDB into Node.js/Next.js apps.