Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add majiayu000/spellbook --skill app-user-story-qagit clone --depth 1 https://github.com/majiayu000/spellbookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/majiayu000/spellbook/app-user-story-qa)<a href="https://agentmods.dev/skills/majiayu000/spellbook/app-user-story-qa"><img src="https://agentmods.dev/badge/skills/majiayu000/spellbook/app-user-story-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/majiayu000/spellbook/app-user-story-qa"><img src="https://agentmods.dev/badge/skills/majiayu000/spellbook/app-user-story-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01759 |
| Opus 5 | $0.00027 | $0.00879 |
| Sonnet 5 | $0.00011 | $0.00352 |
| Haiku 4.5 | $0.00005 | $0.00176 |
Grade A, and why
app-user-story-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App User Story QA
Purpose
Use this skill to turn a broad "test every feature in this app" request into a controlled loop with one source of truth. Anchor every feature to code, track expected behavior in a canonical spreadsheet, run tests against each user story, and classify failures. Apply fixes only when the current request explicitly authorizes them.
Route
Use plan_first for most runs. Switch to clarify_first only when the app boundary, writable checkout, production risk, or acceptance criteria are unclear enough that a wrong assumption would waste substantial work.
Before editing:
- Run a repo state snapshot: current path, branch, latest remote, dirty files, open PRs when relevant.
- If the checkout is dirty or user work is present, first decide which state the user asked to test. Preserve current user work in the isolated test worktree when the request targets the working tree; use a clean base only when the user asked for the base branch.
- Read applicable repo instructions such as
AGENTS.md,README, architecture docs, and feature entrypoints. - Search for existing QA trackers before creating a new one.
- Define the app boundary by user-facing surfaces, not internal helper functions.
Operating Contract
Select one mode before editing production code:
report_onlyis the default for audit, inventory, test, diagnose, or tracker requests. It may create or update the requested canonical tracker and run tests, but it must not change product behavior.apply_fixesrequires the current user request to explicitly ask for fixes. It covers only defects already reproduced and classified within the agreed app boundary. Earlier approval and a generic request to "test everything" do not authorize fixes.
If the mode is ambiguous, use report_only and record proposed fixes in the tracker.
Direct actions:
- Inventory local code and docs, create or update the single canonical tracker, run local tests, and document failures.
- In
apply_fixesonly, fix narrow in-scope logistical or UX defects and add focused coverage when user-observable behavior changes.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 170 lines · 54 tokens per session scan A 661a06b5a1a6
app-user-story-qa is a skill published in the GitHub repository majiayu000/spellbook (278 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 1,759 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ring:checking-frontend-quality
Checking frontend quality against changed UI via ring:qa-frontend in accessibility, visual, e2e, or performance mode and aggregating pass/fail verdicts. Use when a frontend change needs standalone a11y, visual-snapshot, Playwright e2e, or Lighthouse/Core-Web-Vitals validation outside the dev cycle. Skip for…
Cursor rules for avoiding placeholder or broken image URLs, using stable visual
Cursor rules for avoiding placeholder or broken image URLs, using stable visual assets, and checking alt text, dimensions, licensing, and responsive behavior.
Playwright E2E Testing
Use this skill when you need high-confidence coverage of user flows (auth, uploads, payments, chat flows) and you want stable, debuggable Playwright tests.
Tailwind CSS Patterns
Use this skill when styling UI with Tailwind and you want consistent design tokens, maintainable class composition, and good accessibility defaults.
Cursor rules for embedding Beefree SDK's no-code content editors (for emails, pa
Cursor rules for embedding Beefree SDK's no-code content editors (for emails, pages, and popups) into a web application.
Guidelines and best practices for building applications with [Beefree SDK](https
Guidelines and best practices for building applications with Beefree SDK, including installation, authentication, configuration, customization, and template management.