Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mikeparcewski/wicked-garden --skill qe-exploratory-testergit clone --depth 1 https://github.com/mikeparcewski/wicked-gardenWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mikeparcewski/wicked-garden/qe-exploratory-tester)<a href="https://agentmods.dev/skills/mikeparcewski/wicked-garden/qe-exploratory-tester"><img src="https://agentmods.dev/badge/skills/mikeparcewski/wicked-garden/qe-exploratory-tester/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mikeparcewski/wicked-garden/qe-exploratory-tester"><img src="https://agentmods.dev/badge/skills/mikeparcewski/wicked-garden/qe-exploratory-tester.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.00413 |
| Opus 5.5 | $0.00029 | $0.00165 |
| Sonnet 5.5 | $0.00015 | $0.00083 |
| Haiku 4.5 | $0.00007 | $0.00041 |
Grade A, and why
wicked-garden-qe-exploratory-tester scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Exploratory Tester
Scripted tests find bugs you predicted. Exploratory testing finds the ones you didn't. You operate charter-driven for a time-boxed session and produce a report.
Session shape
- Charter — one sentence: "Explore X with Y in mind, looking for Z"
- Time-box — 60 to 120 minutes
- Notes — observations, questions, anomalies, bugs as they happen
- Debrief — summary with ranked findings
Heuristics to apply
- SFDIPOT (structure, function, data, interfaces, platform, operations, time)
- CRUSSPIC STMPL (resource-oriented): capability, reliability, usability, security, scalability, performance, installability, compatibility …
- FEW HICCUPS (data-oriented): history, input, count, character (chars), user, position, state …
- Pairwise combinations for option-heavy UIs
- Boundary ambiguity — anywhere the spec says "usually" or "typically"
Rules
- No test scripts — operate like a curious user
- Record everything, even false alarms (they might pattern later)
- Hunt for the weird, not just the broken
- Return a report with severity-ranked findings + follow-up charters
Output
A session report:
- Charter (what you explored)
- Time spent
- Findings (bug / question / risk / kudo) with severity
- Follow-up charters (what to explore next)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -7 lines 71847ccab2c9
- 1mo ago Changed · +2 lines ce3f7a0d1319
- 1mo ago First seen · 57 lines · 73 tokens per session scan A b91e6a5c7d90
wicked-garden-qe-exploratory-tester is a skill published in the GitHub repository mikeparcewski/wicked-garden (9 stars, last pushed yesterday), licensed MIT. It adds 73 tokens to every session and 413 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
test-runner
Use this skill when orchestrating agentic end-to-end tests. Resolves target + profile, dispatches the right driver(s) (playwright for web today, peekaboo for macOS (issue #381)), invokes the ux-evaluator agent (opus, read-only) against driver artifacts, reconciles findings with the open issue tracker via…
runtime-verification
Verify code works at runtime through build verification (mandatory), LSP diagnostics, ad-hoc verification for projects without frameworks, E2E and smoke tests, and visual verification (screenshot-analyze-verify for UI changes). Skip whitelist strictly enforced (markdown-only, config-only, dependency-bump-only with…
eval-integration
Specialized integration evaluator for the Evaluate-Loop. Use this for evaluating tracks that integrate external services — Supabase auth/DB, Stripe payments, Gemini API, third-party APIs. Checks API contracts, auth flows, data persistence, error recovery, environment config, and end-to-end flow integrity. Dispatched…
browser-test-self-healing
Build an AgentWorks workflow that diagnoses a browser-test failure, proposes a test-only repair, verifies it in isolation, obtains the configured review, and updates canonical tests and application knowledge. Use for stale or flaky browser automation, not product defects.
flaky-test-detection-stabilization
Build AgentWorks browser-test flake detection and reviewed stabilization using repeated isolated attempts and evidence comparison. Use when identical test inputs produce inconsistent outcomes.
parallel-gate-legs-killed-for-memory-count-cannot-see-ram
Two sessions run local test legs on the same machine and one session's leg is killed for memory mid-run, while the concurrency guard everybody uses — a count of running test processes — reads well inside its limit the whole time. Use when: (1) a background test run ends with a harness notice like "stopped because the…