Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-output-validationgit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-output-validation)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-output-validation"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-output-validation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-output-validation"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-output-validation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00132 | $0.03280 |
| Opus 5 | $0.00066 | $0.01640 |
| Sonnet 5 | $0.00026 | $0.00656 |
| Haiku 4.5 | $0.00013 | $0.00328 |
Grade A, and why
qa-output-validation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 304 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及对虚无功能的删除或标记建议。 实际使用时请勿直接删除测试用例或功能项，先确认其来源并备份原数据。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
输出验证
核心原则
AI可能编造不存在的内容——必须验证每个输出的依据。
验证维度
维度1：事实核查
目标：验证AI输出是否基于真实信息，而非编造
检查点：
├─ 需求是否真实存在？
│ └─ 用例中的需求ID是否在需求解构表中？
├─ 风险是否合理推断？
│ └─ 风险ID是否基于实际风险分析？
├─ 边界是否可验证？
│ └─ 边界条件是否真实存在？
├─ 行业标准是否准确？
│ └─ 引用的行业知识是否正确？
└─ 历史缺陷是否真实？
└─ 引用的历史缺陷是否有依据？
防幻觉检查：
├─ 检查是否有"凭空捏造"的内容
├─ 检查是否有"过度推断"的内容
├─ 检查是否有"错误引用"的内容
└─ 检查是否有"逻辑矛盾"的内容
维度2：一致性检查
目标：验证输出各部分是否一致
检查点：
├─ 需求ID与用例是否一一对应？
│ └─ 每条用例的需求ID是否在需求列表中？
├─ 风险ID与用例是否匹配？
│ └─ 风险等级是否与用例内容一致？
├─ 场景与边界是否对应？
│ └─ 边界是否覆盖了相关场景？
├─ 评审结果与实际输出是否一致？
│ └─ 评审指出的问题是否已修正？
└─ 不同技能输出是否矛盾？
└─ 需求解构、场景树、边界分析是否一致？
一致性矩阵：
| 维度1 | 维度2 | 检查项 |
|-------|-------|--------|
| 需求 | 用例 | 需求ID是否匹配 |
| 风险 | 用例 | 风险ID是否匹配 |
| 场景 | 边界 | 边界是否覆盖场景 |
| 评审 | 输出 | 问题是否已修正 |
维度3：可执行性验证
目标：验证测试用例是否可实际执行
检查点：
├─ 测试步骤是否具体可操作？
│ └─ 步骤是否清晰到可以由任何人执行？
├─ 预期结果是否可验证？
│ └─ 预期结果是否客观可测量？
├─ 测试数据是否可构造？
│ └─ 需要的测试数据能否准备？
├─ 测试环境是否可搭建？
│ └─ 需要的环境能否搭建？
└─ 测试工具是否可用？
└─ 需要的工具是否可获取？
可执行性评分：
- 10分：完全可执行，无任何障碍
- 7分：基本可执行，少量障碍可克服
- 4分：部分可执行，有明显障碍
- 1分：无法执行，需要重新设计
维度4：来源追溯
目标：标注每个输出的来源和依据
追溯内容：
├─ 需求来源：来自用户输入/需求文档
├─ 风险来源：来自风险分析/行业经验
├─ 边界来源：来自边界分析/最佳实践
├─ 用例来源：来自哪个技能生成
└─ 评审来源：来自哪个评审维度
追溯格式：
每条用例标注：
- 需求来源：REQ-XXX（来自需求解构）
- 风险来源：RISK-XXX（来自风险分析）
- 生成来源：qa-ai-prompt-strategy
- 评审状态：已评审/未评审
验证流程
步骤1：事实核查
执行内容：
1. 对比用例中的需求ID与需求解构表
2. 检查风险ID是否基于实际分析
3. 验证边界条件是否真实存在
4. 检查引用的行业知识是否准确
输出：
├─ 核查通过项：[列表]
├─ 核查失败项：[列表]
└─ 幻觉风险项：[列表]
步骤2：一致性检查
执行内容：
1. 验证需求ID与用例的对应关系
2. 验证风险ID与用例的匹配关系
3. 验证场景与边界的覆盖关系
4. 验证评审结果与实际输出的一致性
输出：
├─ 一致项：[列表]
├─ 不一致项：[列表]
└─ 矛盾项：[列表]
步骤3：可执行性验证
执行内容：
1. 检查测试步骤的具体性
2. 检查预期结果的可验证性
3. 检查测试数据的可构造性
4. 检查测试环境的可搭建性
输出：
├─ 可执行项：[列表]
├─ 部分可执行项：[列表]
└─ 不可执行项：[列表]
步骤4：生成验证报告
## 输出验证报告
### 验证摘要
- 验证日期：YYYY-MM-DD
- 用例总数：XX条
- 验证结果：通过/不通过
### 事实核查
| 检查项 | 结果 | 说明 |
|--------|------|------|
| 需求真实性 | 通过/失败 | [说明] |
| 风险合理性 | 通过/失败 | [说明] |
| 边界可验证性 | 通过/失败 | [说明] |
| 行业标准准确性 | 通过/失败 | [说明] |
### 一致性检查
| 检查项 | 结果 | 说明 |
|--------|------|------|
| 需求ID匹配 | 通过/失败 | [说明] |
| 风险ID匹配 | 通过/失败 | [说明] |
| 场景边界对应 | 通过/失败 | [说明] |
| 评审结果一致 | 通过/失败 | [说明] |
### 可执行性验证
| 用例编号 | 可执行性 | 问题 |
|---------|---------|------|
| TC_XXX_001 | 可执行 | - |
| TC_XXX_002 | 部分可执行 | [问题] |
| TC_XXX_003 | 不可执行 | [问题] |
### 问题清单
| 问题类型 | 用例编号 | 问题描述 | 严重程度 |
|---------|---------|---------|---------|
| 幻觉 | TC_XXX_001 | 需求ID不存在 | 高 |
| 不一致 | TC_XXX_002 | 风险等级与内容不符 | 中 |
| 不可执行 | TC_XXX_003 | 步骤过于模糊 | 中 |
### 验证结论
- 是否通过：是/否
- 主要问题：[描述]
- 建议：[建议]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 2aaf1c119c33
- 9d ago First seen · 304 lines · 132 tokens per session scan A 1f2252b378f1
qa-output-validation is a skill published in the GitHub repository Kokxi/qa-test-skills (24 stars, last pushed 7d ago), licensed MIT. It adds 132 tokens to every session and 3,280 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…
octocode-graph-eval
Use when you need a measurable keep/discard loop — goal→KPI, baseline vs target, held-out checks, eval suites, or don't-stop-till-done against a runnable sensor. Not for ordinary ship checks where 'tests passed' is enough.
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.
modernize-test-starter
Modernize QUnit unit tests and OPA5 integration tests to the UI5 Test Starter concept. Use this skill when: The linter reports prefer-test-starter for .qunit.html or .qunit.js files Test HTML files use manual sap-ui-core.js bootstrapping instead of Test Starter's runTest.js/createSuite.js Test JS files use…
javascript-development
JavaScript/TypeScript ES2024+, async/await, DOM manipulation, Node.js, and API integration. Use when writing vanilla JS/TS code, working with REST/fetch APIs, implementing frontend logic, or configuring JS build tools.