Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-req-deconstructiongit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-req-deconstruction)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-req-deconstruction"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-req-deconstruction/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-req-deconstruction"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-req-deconstruction.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.03361 |
| Opus 5 | $0.00062 | $0.01681 |
| Sonnet 5 | $0.00025 | $0.00672 |
| Haiku 4.5 | $0.00012 | $0.00336 |
Grade A, and why
qa-req-deconstruction scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 307 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚠️ 安全警告：本技能的示例可能涉及订单号、支付金额、截图、身份证、手机号等敏感数据。 实际使用时请勿粘贴真实生产数据、客户信息或财务凭证；测试前应脱敏/掩码处理。 本技能仅在 workspace/ 输出评估文件，不持久化、不外传、不跨会话复用。
需求解构
核心原则
专家看需求文档，看到的不只是文字，而是背后的测试模型。
需求挖掘深度要求（参考值）
关键指标：根据项目复杂度调整
| 复杂度 | 倍数 | 示例（显性5条） |
|---|---|---|
| 简单项目 | ×2 | 总需求10条 |
| 中等项目 | ×3 | 总需求15条 |
| 复杂项目 | ×4 | 总需求20条 |
复杂度判断标准：
- 简单：单模块、低风险、无并发
- 中等：多模块、中风险、少量并发
- 复杂：跨模块、高风险、高并发
需求三层次模型
第1层：显性需求
是什么：文档明确写出的内容
提取方法：
1. 逐条阅读需求文档
2. 标注每条需求的关键词
3. 分类整理：功能需求、非功能需求、约束条件
4. 输出：显性需求清单（每条带REQ-ID）
检查清单：
- [ ] 所有功能点是否提取？
- [ ] 所有约束条件是否提取？
- [ ] 所有非功能需求是否提取？
- [ ] 每条需求是否可测试？
第2层：隐性需求
是什么：文档没写但隐含的需求
挖掘方法（五问法）：
1. 对每个"应该"问"如果不呢？"
2. 对每个"正常"问"异常呢？"
3. 对每个"确定"问"假设呢？"
4. 对每个"存在"问"不存在呢？"
5. 对每个"并发"问"同时操作呢？"
隐性需求类型：
├─ 业务隐含：业务流程的隐含步骤
├─ 技术隐含：技术实现的隐含约束
├─ 用户隐含：用户行为的隐含假设
├─ 环境隐含：运行环境的隐含条件
├─ 数据隐含：数据状态的隐含变化
├─ 并发隐含：并发操作的隐含冲突
├─ 时序隐含：操作顺序的隐含依赖
└─ 异常隐含：异常情况的隐含处理
检查清单：
- [ ] 库存相关隐性需求是否挖掘？
- [ ] 并发相关隐性需求是否挖掘？
- [ ] 时序相关隐性需求是否挖掘？
- [ ] 异常处理隐性需求是否挖掘？
- [ ] 数据一致性隐性需求是否挖掘？
- [ ] 安全相关隐性需求是否挖掘？
第3层：衍生需求
是什么：从显性和隐性需求推导出的需求
推导方法：
1. 从用户角色推导：不同角色有什么需求？
2. 从使用场景推导：不同场景有什么需求？
3. 从边界条件推导：极端情况有什么需求？
4. 从关联功能推导：相关功能有什么需求？
5. 从数据流向推导：数据在模块间怎么流？
检查清单：
- [ ] 不同用户角色需求是否推导？
- [ ] 不同使用场景需求是否推导？
- [ ] 边界条件需求是否推导？
- [ ] 关联功能需求是否推导？
- [ ] 数据流向需求是否推导？
推导示例：
- 显性："密码至少8位" → 隐性：密码强度规则？特殊字符？
- 显性："发送验证码" → 隐性：验证码有效期？发送频率限制？
五维拆解框架
维度1：输入拆解
用户输入什么？
├─ 输入类型：文本、数字、文件、选择
├─ 输入来源：手动输入、自动填充、第三方获取
├─ 输入限制：必填/选填、长度、格式、范围
├─ 输入异常：空值、超长、格式错误、特殊字符
└─ 输入关联：多个输入间的依赖关系
维度2：操作拆解
用户能做什么？
├─ 核心操作：主要功能路径
├─ 辅助操作：次要功能路径
├─ 禁止操作：不允许的操作
├─ 操作顺序：操作间的依赖关系
└─ 操作权限：谁能做什么操作
维度3：状态拆解
系统有哪些状态？
├─ 业务状态：待处理、处理中、已完成、已取消
├─ 数据状态：草稿、已发布、已归档
├─ 用户状态：未激活、正常、冻结、注销
├─ 状态流转：状态变更的条件和路径
└─ 状态异常：非法状态转换怎么处理
维度4：输出拆解
系统返回什么？
├─ 正常输出：成功时的返回内容
├─ 异常输出：失败时的返回内容
├─ 输出格式：JSON、HTML、文件
├─ 输出内容：数据、提示、错误信息
└─ 输出关联：多个输出间的一致性
维度5：规则拆解
业务规则是什么？
├─ 计算规则：公式、算法、精度
├─ 校验规则：格式、范围、关联
├─ 权限规则：角色、资源、操作
├─ 流程规则：步骤、条件、分支
└─ 规则冲突：规则间的优先级和矛盾
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 0814577c523b
- 9d ago First seen · 307 lines · 124 tokens per session scan A d4767c3f5f1c
qa-req-deconstruction is a skill published in the GitHub repository Kokxi/qa-test-skills (24 stars, last pushed 7d ago), licensed MIT. It adds 124 tokens to every session and 3,361 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…
octocode-graph-eval
Use when you need a measurable keep/discard loop — goal→KPI, baseline vs target, held-out checks, eval suites, or don't-stop-till-done against a runnable sensor. Not for ordinary ship checks where 'tests passed' is enough.
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.
modernize-test-starter
Modernize QUnit unit tests and OPA5 integration tests to the UI5 Test Starter concept. Use this skill when: The linter reports prefer-test-starter for .qunit.html or .qunit.js files Test HTML files use manual sap-ui-core.js bootstrapping instead of Test Starter's runTest.js/createSuite.js Test JS files use…
aiox-qa
Activate Quinn (qa) for Test Architect & Quality Advisor. Use for comprehensive test architecture review, quality gate decisions, and code improvement. Provides thorough analysis including requirements traceability, risk assessment, and...