Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-code-review-for-testgit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-code-review-for-test)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-code-review-for-test"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-code-review-for-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-code-review-for-test"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-code-review-for-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.02033 |
| Opus 5 | $0.00059 | $0.01017 |
| Sonnet 5 | $0.00024 | $0.00407 |
| Haiku 4.5 | $0.00012 | $0.00203 |
Grade A, and why
qa-code-review-for-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及代码变更分析（新增/修改/删除/重构）。 实际使用时请勿直接基于评审结论修改源码，先与开发确认变更范围和回归风险。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
测试视角的代码评审
核心原则
看代码不是为了Review代码质量，而是判断变更影响范围、识别需要重点回归的区域。
代码读取许可：本技能需要读取代码变更（git diff）进行分析，仅关注测试影响，不评估代码质量。
深度要求（参考值）
关键指标：根据代码变更复杂度调整CR深度
| 复杂度 | CR检查点要求 | 说明 |
|---|---|---|
| 简单变更 | 5-8个检查点 | 单文件/配置/文案变更 |
| 中等变更 | 12-20个检查点 | 多文件/逻辑修改 |
| 复杂变更 | 25-40个检查点 | 重构/重写/核心模块变更 |
测试视角CR四看
第1看：看diff（改了什么）
分析维度：
├─ 新增文件：新增了哪些文件？
├─ 修改文件：修改了哪些文件？
├─ 删除文件：删除了哪些文件？
├─ 代码行数：新增/修改/删除多少行？
└─ 变更类型：功能/修复/重构/配置？
关注点：
- 核心逻辑变更
- 数据库变更
- 配置变更
- 接口变更
第2看：看影响（波及哪里）
分析维度：
├─ 调用方：哪些地方调用了这个方法？
├─ 数据流向：数据从哪来、到哪去？
├─ 接口变更：对外接口有没有变？
├─ 数据库变更：表结构/索引有没有变？
└─ 配置变更：配置项有没有变？
关注点：
- 影响范围评估
- 需要回归的区域
- 需要新增的测试场景
第3看：看风险模式（有什么风险）
风险模式识别：
├─ 静态数据变化：硬编码的值变了
├─ 超时/重试：涉及超时或重试逻辑
├─ 异常吞没：异常被catch但没处理
├─ 并发处理：涉及多线程/分布式锁
├─ 状态管理：涉及状态变更
├─ 权限控制：涉及认证/授权
├─ 数据转换：涉及格式/类型转换
└─ 外部依赖：涉及第三方服务
关注点：
- 每个风险模式对应的测试场景
- 需要重点验证的区域
第4看：看测试建议（怎么测）
测试建议输出：
├─ 回归测试：哪些功能需要回归？
├─ 新增测试：需要新增哪些测试场景？
├─ 重点测试：哪些区域需要深测？
├─ 性能测试：是否需要性能测试？
└─ 安全测试：是否需要安全测试？
输出格式：
[变更描述]
├─ 影响范围：[影响的功能/模块]
├─ 回归范围：[需要回归的功能]
├─ 新增场景：[需要新增的测试场景]
├─ 重点区域：[需要深测的区域]
└─ 测试建议：[具体的测试建议]
代码评审检查清单
功能变更检查
- 业务逻辑是否正确？
- 边界条件是否处理？
- 异常处理是否完善？
- 数据校验是否完整？
数据变更检查
- 数据库变更是否兼容？
- 数据迁移是否安全？
- 索引变更是否影响性能？
- 数据一致性是否保证？
接口变更检查
- 接口入参是否兼容？
- 接口出参是否变化？
- 错误码是否变化？
- 文档是否更新？
配置变更检查
- 配置项是否新增？
- 默认值是否合理？
- 环境差异是否考虑？
- 回滚方案是否准备？
性能变更检查
- 是否有性能影响？
- 是否有内存泄漏风险？
- 是否有并发问题？
- 是否有资源竞争？
应用场景
开发提交了登录模块的代码变更 → CR四看分析：
- 看diff：修改了LoginController.java，新增密码加密逻辑
- 看影响：影响登录流程、密码验证、Session创建
- 看风险模式：加密算法变更可能导致兼容性问题
- 看测试建议：回归登录成功/失败流程，新增加密算法兼容性测试
配置项变更（数据库连接池大小调整） → 影响范围评估：确定需要回归的接口和场景
自检清单
代码评审完成后检查：
- 是否分析了diff内容？
- 是否评估了影响范围？
- 是否识别了风险模式？
- 是否给出了测试建议？
- 建议是否可执行？
检查清单
- 变更类型是否识别？
- 影响范围是否分析？
- 高风险模式是否标注？
- 回归范围是否建议？
- 可测试性问题是否提出？
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 4594c2aa4417
- 10d ago First seen · 207 lines · 118 tokens per session scan A ef20716e6838
qa-code-review-for-test is a skill published in the GitHub repository Kokxi/qa-test-skills (25 stars, last pushed 7d ago), licensed MIT. It adds 118 tokens to every session and 2,033 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
apply-qa-fixes
Apply QA gate findings then hand back for re-review. Never self-approves or closes. Use when: apply QA fixes, remediate gate FAIL/CONCERNS, /apply-qa-fixes.
dotnet-best-practices
Ensure .NET/C# code follows maintainable, modern best practices. Use when reviewing or improving C# code, solution structure, async patterns, dependency injection, or testability.
pr-description-generator
Generates comprehensive, structured PR descriptions from git diff or branch comparison. Includes summary, changelog, testing notes, and deployment considerations.
code-quality-suite
A combined guide for code review and unit testing, where small automated tests check individual pieces of code.
generator-evaluator-loop
Orchestrate a Coder→Quality iteration loop against a story's Verification contract. Use when a story has a complete Verification section and is ready for execution with automated review.
qcsd-development-swarm
QCSD Development phase swarm for in-sprint code quality assurance using TDD adherence, code complexity analysis, coverage gap detection, and defect prediction. Consumes Refinement outputs (BDD scenarios, SFDIPOT priorities) and produces signals for Verification.