Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kokxi/qa-test-skills --skill qa-risk-intuitiongit clone --depth 1 https://github.com/Kokxi/qa-test-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kokxi/qa-test-skills/qa-risk-intuition)<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-risk-intuition"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-risk-intuition/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kokxi/qa-test-skills/qa-risk-intuition"><img src="https://agentmods.dev/badge/skills/kokxi/qa-test-skills/qa-risk-intuition.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.02412 |
| Opus 5 | $0.00063 | $0.01206 |
| Sonnet 5 | $0.00025 | $0.00482 |
| Haiku 4.5 | $0.00013 | $0.00241 |
Grade A, and why
qa-risk-intuition scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 239 lines — stays where its author put it; the contents beside it link to each section on GitHub.
风险直觉与优先级判断
核心原则
有经验的测试看到某些变更会本能地警觉——这不是玄学，是可以结构化的信号模型。通过风险信号雷达（变更/业务/数据/集成/技术）系统识别风险。每个风险点标注概率和影响等级，附缓解建议。
风险评估要求
关键指标：每个功能模块至少识别5个风险点
风险评估公式：
风险等级 = 业务影响 × 发生概率 × 技术复杂度
风险等级划分：
├─ 高风险（≥15分）：必须深测，100%覆盖
├─ 中风险（8-14分）：常规测试，80%覆盖
└─ 低风险（≤7分）：冒烟测试，50%覆盖
风险信号雷达
📖 五大风险信号雷达（变更类型/业务影响/技术复杂度/数据风险/集成风险）及风险检查清单详见
references/risk-signals.md。加载时机：执行风险评估时由本技能按需读取，避免占用主 context。
风险评估输出格式
## 风险评估报告
### 高风险区域（必须深测）
| 风险点 | 风险类型 | 风险等级 | 测试建议 |
|--------|---------|---------|---------|
| [风险描述] | 业务/技术/变更 | 高 | [测试建议] |
### 中风险区域（常规测试）
| 风险点 | 风险类型 | 风险等级 | 测试建议 |
|--------|---------|---------|---------|
| [风险描述] | 业务/技术/变更 | 中 | [测试建议] |
### 低风险区域（冒烟测试）
| 风险点 | 风险类型 | 风险等级 | 测试建议 |
|--------|---------|---------|---------|
| [风险描述] | 业务/技术/变更 | 低 | [测试建议] |
风险评估矩阵
风险等级计算
风险等级 = 业务影响 × 发生概率 × 技术复杂度
业务影响：
- 高：5分（资金、安全、核心链路）
- 中：3分（内部管理、辅助功能）
- 低：1分（内部工具、文档）
发生概率：
- 高：5分（经常出问题）
- 中：3分（偶尔出问题）
- 低：1分（很少出问题）
技术复杂度：
- 高：5分（并发、状态、分布式）
- 中：3分（复杂规则、数据转换）
- 低：1分（简单CRUD、静态展示）
风险分数（闭区间，边界归高）：
- ≥75：高风险（必须深测）
- 25-74：中风险（常规测试）
- ≤24：低风险（冒烟测试）
风险评估表
| 功能模块 | 业务影响 | 发生概率 | 技术复杂度 | 风险分数 | 风险等级 | 测试深度 |
|---|---|---|---|---|---|---|
| 支付模块 | 5 | 3 | 5 | 75 | 高 | 深测 |
| 用户模块 | 5 | 5 | 3 | 75 | 高 | 深测 |
| 通知模块 | 1 | 3 | 1 | 3 | 低 | 冒烟 |
测试资源分配
高风险区域（深测）
测试策略：
- 全场景覆盖
- 边界条件深挖
- 并发场景测试
- 异常恢复测试
- 性能压力测试
- 安全渗透测试
测试用例数：充足
测试时间：充足
测试人员：资深测试
中风险区域（常规测试）
测试策略：
- 主路径覆盖
- 关键分支覆盖
- 常见异常覆盖
- 基础边界测试
测试用例数：适中
测试时间：适中
测试人员：初中级测试
低风险区域（冒烟测试）
测试策略：
- 主路径冒烟
- 关键功能验证
- 基础回归测试
测试用例数：精简
测试时间：有限
测试人员：自动化
输出示例
好示例：支付模块升级风险评估
✓ 变更类型：支付网关替换（高风险）
- 业务影响：资金相关，影响所有交易（严重度=10）
- 技术复杂度：涉及第三方SDK替换、回调接口改造（复杂度=8）
- 数据风险：交易记录迁移、对账数据一致性（数据风险=7）
→ 风险等级=10×8×7=560 → 高风险
→ 测试策略：全量回归+专项兼容测试+灰度验证
→ 资源分配：分配2人专项测试2周，线上灰度观察3天
坏示例：支付模块升级风险评估
✗ 风险不大，简单测测就行了
- 没说替换了多少接口，没评估影响范围
- 没考虑资金安全，没考虑第三方不可用
- 没区分"灰度验证"和"全量上线"
→ 结果：上线后才发现新网关回调格式不一致，导致订单状态不同步
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed fc293e0f8f73
- 11d ago First seen · 239 lines · 126 tokens per session scan A 6fe9b717f181
qa-risk-intuition is a skill published in the GitHub repository Kokxi/qa-test-skills (25 stars, last pushed 9d ago), licensed MIT. It adds 126 tokens to every session and 2,412 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sparc-methodology
SPARC (Specification, Pseudocode, Architecture, Refinement, Completion) comprehensive development methodology with multi-agent orchestration.
swarm-advanced
Advanced swarm orchestration patterns for research, development, testing, and complex distributed workflows.
code-review
Reviews Spec Kit code changes for positive and negative test coverage, regression evidence for bug fixes, and consistent repository terminology. Use when reviewing a diff or pull request. Do not use for implementing changes or posting GitHub review actions.
agent-harness-fault-injection
Use when an agent workflow needs deterministic recovery evidence for sandbox, MCP/tool, worker, checkpoint, memory, or orchestration failures.
octocode-benchmark
Use when planning, running, grading, or reporting the by-hand Octocode research benchmark — pairwise matchups (Octocode anchor vs one baseline: gh+RTK, gh+Headroom, or plain gh) over markdown questions, with a fresh isolated runner agent per (question, arm, pass), one blind judge per question grading two answers X/Y…
octocode-graph-eval
Use when you need a measurable keep/discard loop — goal→KPI, baseline vs target, held-out checks, eval suites, or don't-stop-till-done against a runnable sensor. Not for ordinary ship checks where 'tests passed' is enough.