Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-input-validationgit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-input-validation)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-input-validation"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-input-validation.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.02492 |
| Opus 5 | $0.00049 | $0.01246 |
| Sonnet 5 | $0.00020 | $0.00498 |
| Haiku 4.5 | $0.00010 | $0.00249 |
Grade A, and why
qa-input-validation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 257 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告:本技能的示例可能涉及订单号、支付金额、截图、身份证、手机号等敏感数据。 实际使用时请勿粘贴真实生产数据、客户信息或财务凭证;测试前应脱敏/掩码处理。 本技能仅在 workspace/ 输出评估文件,不持久化、不外传、不跨会话复用。
输入验证
核心原则
垃圾进,垃圾出——输入质量决定输出质量。 本技能是整个QA Test Skills工作流的第一步,在需求评审之前执行,验证输入是否满足生成高质量测试用例的基本要求。
验证维度
维度1:需求明确性
检查点:
├─ 是否有明确的功能描述?
├─ 是否有业务目标?
├─ 是否有用户角色?
└─ 是否有成功标准?
评分标准:
- 10分:需求完整清晰,包含所有必要信息
- 7分:需求基本清晰,缺少少量信息
- 4分:需求模糊,缺少关键信息
- 1分:需求不明,无法理解
维度2:上下文充分性
检查点:
├─ 是否有业务背景?
├─ 是否有技术架构?
├─ 是否有历史缺陷?
├─ 是否有约束条件?
└─ 是否有参考文档?
评分标准:
- 10分:上下文完整,可直接生成
- 7分:上下文基本充分,可补充少量信息
- 4分:上下文不足,需要补充
- 1分:上下文缺失,无法生成
维度3:输入类型识别
输入类型:
├─ 直接描述:文字描述需求
├─ 上传文件:附件/文件路径
├─ URL链接:http/https开头
└─ 混合输入:多种类型组合
验证规则:
- 直接描述:检查是否包含功能关键词
- 上传文件:检查文件是否可读取
- URL链接:检查URL是否可访问
- 混合输入:检查各部分是否完整
验证流程
步骤1:解析用户输入
解析内容:
├─ 提取需求描述
├─ 识别输入类型
├─ 检查是否有附件/URL
└─ 提取关键词
步骤2:评估输入质量
评估维度:
├─ 需求明确性(0-10分)
├─ 上下文充分性(0-10分)
├─ 信息完整性(0-10分)
└─ 可测试性(0-10分)
综合评分 = (需求明确性 + 上下文充分性 + 信息完整性 + 可测试性) / 4
步骤3:生成验证结果
结果类型:
├─ pass(通过):综合评分≥7分
├─ need_more_info(需要更多信息):综合评分4-6分
└─ fail(失败):综合评分<4分
输出格式
通过(pass)
{
"validation_result": "pass",
"input_quality_score": 8,
"missing_info": [],
"recommendation": "输入质量良好,可以继续执行"
}
需要更多信息(need_more_info)
{
"validation_result": "need_more_info",
"input_quality_score": 5,
"missing_info": [
"缺少业务背景描述",
"缺少用户角色说明",
"缺少约束条件"
],
"clarification_questions": [
"这个功能的业务目标是什么?",
"主要用户有哪些角色?",
"有什么技术约束或业务规则?"
],
"recommendation": "请补充以上信息后再生成"
}
失败(fail)
{
"validation_result": "fail",
"input_quality_score": 2,
"missing_info": [
"缺少功能描述",
"缺少业务背景",
"缺少所有必要信息"
],
"clarification_questions": [
"请描述需要测试的功能是什么",
"这个功能的业务背景是什么",
"主要用户是谁,核心流程是什么"
],
"recommendation": "输入信息严重不足,无法生成有效测试用例"
}
输入类型速查表
| 输入类型 | 示例 | 验证重点 | 典型评分区间 |
|---|---|---|---|
| 功能名称 | "测试登录" | 缺业务目标、用户角色、约束 | 4-6分 |
| 场景描述 | "用户输入密码错误3次锁定" | 缺边界条件、非功能需求 | 6-8分 |
| PRD文档 | 上传完整需求文档 | 检查可读性、覆盖度、歧义 | 7-10分 |
| URL链接 | 需求文档链接 | 检查可访问性、内容完整性 | 5-9分 |
| 截图/图片 | 功能截图 | 缺完整上下文、业务规则 | 3-6分 |
| Bug描述 | "XX功能报错了" | 缺复现步骤、环境、数据 | 3-5分 |
| 混合输入 | 描述+附件+URL | 各部分一致性、互补性 | 6-9分 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 72ac2f97007e
- 6d ago First seen · 257 lines · 99 tokens per session scan A 25e47aae3606
qa-input-validation is a skill published in the GitHub repository Kokxi/qa-test-skills (24 stars, last pushed 4d ago), licensed MIT. It adds 99 tokens to every session and 2,492 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
swarm-advanced
Advanced swarm orchestration patterns for research, development, testing, and complex distributed workflows.
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…
octocode-graph-eval
Use when you need a measurable keep/discard loop — goal→KPI, baseline vs target, held-out checks, eval suites, or don't-stop-till-done against a runnable sensor. Not for ordinary ship checks where 'tests passed' is enough.
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.