Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-heuristic-checklistgit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-heuristic-checklist)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-heuristic-checklist"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-heuristic-checklist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-heuristic-checklist"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-heuristic-checklist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00134 | $0.02035 |
| Opus 5 | $0.00067 | $0.01018 |
| Sonnet 5 | $0.00027 | $0.00407 |
| Haiku 4.5 | $0.00013 | $0.00203 |
Grade A, and why
qa-heuristic-checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及被测对象的增删改操作描述（如购物车删除商品）。 这些是测试场景示例，不是对本技能数据的操作；请勿在测试执行中误删真实数据。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
启发式检查清单
无复盘数据时的兜底策略：如果当前没有
qa-retrospective的输出数据（首次使用或复盘未执行），直接使用本技能内置的默认检查清单模板，覆盖以下 8 类常见功能测试要点。上游依赖为可选，不阻塞工作流执行。
核心原则
对不同类型的功能，资深测试脑子里有一份"这类功能通常要测什么"的 mental checklist。
功能类型清单
必须掌握的8大功能类型：
| 类型 | 典型场景 | 测试重点 |
|---|---|---|
| 表单类 | 登录、注册、搜索、提交 | 输入验证、业务规则、用户体验 |
| 列表类 | 商品列表、订单列表、数据报表 | 数据展示、分页、筛选、排序 |
| 购物车类 | 电商购物车、收藏夹 | 库存、价格、并发、数据一致性 |
| 支付类 | 在线支付、退款、转账 | 金额安全、状态一致性、幂等性 |
| 导入导出类 | 批量导入、数据导出 | 格式兼容、数据校验、性能 |
| 审批类 | 请假审批、报销审批 | 流程控制、权限、通知 |
| 消息通知类 | 系统通知、推送消息 | 触发条件、发送频率、渠道 |
| 权限类 | 角色管理、资源权限 | 越权防护、权限继承、审计 |
每个功能类型的完整检查清单（输入验证/业务规则/并发/异常等详细测试要点）参见
references/checklists.md。
使用方法
步骤1：识别功能类型
这个功能属于哪种类型？
- [ ] 表单类
- [ ] 列表类
- [ ] 购物车类
- [ ] 支付类
- [ ] 导入导出类
- [ ] 审批类
- [ ] 消息通知类
- [ ] 权限类
步骤2：应用检查清单
根据功能类型，逐项检查：
1. [ ] 核心测试要点是否覆盖？
2. [ ] 边界条件是否分析？
3. [ ] 异常场景是否考虑？
4. [ ] 用户体验是否验证？
步骤3：补充特定场景
根据业务特点，补充特定测试场景：
1. 业务特殊规则：
2. 技术特殊约束：
3. 历史缺陷模式：
详细检查清单参见
references/checklists.md，覆盖表单/购物车/列表/支付/导入导出/审批/消息/权限 8 大功能类型。
应用场景
用户说"帮我测购物车功能" → 识别为"购物车类功能"，应用检查清单：
- 添加商品：数量、规格、库存、限购
- 修改数量：增/减/超库存/为0
- 删除商品：单个/批量/删除已失效商品
- 价格计算：单品折扣/满减/运费/优惠券叠加
- 异常：库存不足/下架/价格变动
用户说"测一下审批流程" → 识别为"审批类功能"，检查链式流转、多人审批、驳回重审等要点
输出示例
好示例：识别购物车功能 → 应用购物车清单
✓ 识别结果：购物车类功能
- 商品管理测试：添加（正常/库存不足）、修改数量（边界/库存限制）、删除（单条/批量）
- 价格计算测试：单价×数量、满减与优惠券叠加、运费计算
- 并发测试：最后一件库存多人竞争、多设备同步
- 异常测试：支付中断后购物车状态保持、商品下架后购物车提示
→ 全面覆盖了购物车类功能的核心风险点
坏示例：识别购物车功能 → 泛泛的测试
✗ 打开购物车页面，看看能不能加商品、删商品
- 没测价格变化（促销开始/结束时的价格差异）
- 没测并发（多人抢最后一件库存）
- 没测库存不足/商品下架后的购物车状态
- 没测优惠券叠加逻辑
→ 结果：上线后出现价格显示错误、多人抢购超卖
自检清单
测试设计完成后检查：
- 是否识别了正确的功能类型？
- 是否应用了对应的检查清单？
- 是否补充了业务特定场景？
- 测试要点是否可执行？
检查清单
- 8大功能类型是否都应用？
- 清单覆盖是否完整？
- 遗漏类型是否补全？
- 经验启发式是否标注来源？
- 应用结果是否记录？
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 0365fde62a91
- 11d ago First seen · 168 lines · 134 tokens per session scan A 3ebc212d2e94
qa-heuristic-checklist is a skill published in the GitHub repository Kokxi/qa-test-skills (25 stars, last pushed 9d ago), licensed MIT. It adds 134 tokens to every session and 2,035 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
swarm-advanced
Advanced swarm orchestration patterns for research, development, testing, and complex distributed workflows.
code-review
Reviews Spec Kit code changes for positive and negative test coverage, regression evidence for bug fixes, and consistent repository terminology. Use when reviewing a diff or pull request. Do not use for implementing changes or posting GitHub review actions.
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
qa
QA-test a website or web app and return a 1-5 quality score (5 = flawless, 1 = broken) with evidence. Use when the user wants to test, QA, evaluate, score, or "check how good" a site, page, flow, or app — including a local dev server (e.g. "qa test localhost:5173", "does the checkout work?", "rate this landing page").…
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…