Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add n-n-code/n-n-code-skills --skill tester-mindsetgit clone --depth 1 https://github.com/n-n-code/n-n-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/n-n-code/n-n-code-skills/tester-mindset)<a href="https://agentmods.dev/skills/n-n-code/n-n-code-skills/tester-mindset"><img src="https://agentmods.dev/badge/skills/n-n-code/n-n-code-skills/tester-mindset/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/n-n-code/n-n-code-skills/tester-mindset"><img src="https://agentmods.dev/badge/skills/n-n-code/n-n-code-skills/tester-mindset.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02150 |
| Opus 5.5 | $0.00035 | $0.00860 |
| Sonnet 5.5 | $0.00018 | $0.00430 |
| Haiku 4.5 | $0.00009 | $0.00215 |
Grade A, and why
tester-mindset scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tester Mindset
Design evidence that can reveal a meaningful failure in the claim being tested. Use this as an orthogonal workflow alongside the relevant domain guidance.
For planning or review, return a strategy or findings without editing code or changing external state. For exploratory work, run only authorized, bounded probes. Existing implementation authority covers relevant test changes; do not turn design feedback into an unrelated production refactor.
Load exploration and oracle prompts when a context map, risk category, test-idea tour, or alternative perspective would expose a missing case. Do not exhaust those catalogs for routine work.
When To Use
- design a test plan, validation strategy, QA approach, or acceptance criteria
- identify edge cases, failure modes, adversarial cases, or missing evidence
- decide whether existing tests, metrics, benchmarks, or demos prove enough
- plan or debrief exploratory testing, chartered sessions, or bug hunts
- review test quality and detect weak, tautological, or proof-theater tests
- turn a vague claim such as "this works" into observable checks
- review a change through the question "what consequence was invited?"
Not For
- simply running an existing test command
- broad debugging when the failure is already reproduced and the next step is diagnosis
- security exploit analysis that needs the full
securityworkflow - routine implementation work where ordinary repo validation is enough
Core Workflow
- Map the context. Identify the mission, stakeholders, risks, constraints, team skills, available evidence, and cost of being wrong. There are no universal testing best practices, only practices that fit a context.
- Name the claim. State the belief being tested in falsifiable language. If the claim is vague, split it into behavior, contract, performance, safety, usability, security, trust, maintenance, or process claims.
- Separate testing from checking. Checking applies explicit pass/fail rules to known expectations. Testing is investigation: learning, modeling, exploring, questioning, and interpreting. Automate checks, but do not pretend automation replaces judgment.
- Invite consequence. Name an observation that would disprove the claim or change the next action. If no outcome could change the conclusion, revise the probe.
- Choose a survivable scale. Make the test strong enough to teach and small enough to survive. Prefer cheap probes first, then increase fidelity where risk, irreversibility, or user harm justifies it.
- Choose oracles deliberately. Name how a problem would be recognized: requirements, prior behavior, comparable products, standards, stakeholder expectations, user goals, internal consistency, product purpose, statutes, or expert judgment. Treat every oracle as fallible.
- Inspect the apparatus. Question fixtures, mocks, datasets, metrics, timing, environments, prompts, observers, and definitions of "pass." A failing test may expose a broken question, not only a broken system. Ask whether the fixture, mock, metric, benchmark, prompt, dataset, or environment is the thing actually being validated.
- Let reality disagree. Include paths that can contradict the preferred story: boundary data, malformed input, slow dependencies, retries, concurrency, time, state transitions, upgrade paths, human behavior, adversarial pressure, or conflicting stakeholder values.
- Interpret narrowly. Say what the result proves, what it only suggests, who it matters to, and what remains untouched. Passing evidence reduces uncertainty; it does not convert partial coverage into certainty.
- Choose the next consequence. If risk remains material, recommend the next smallest higher-fidelity check: integration test, exploratory session, benchmark, canary, monitoring, user trial, chaos probe, manual smoke, or review.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -56 lines b3536cce36f9
- 1mo ago First seen · 277 lines · 88 tokens per session scan A f17fcecdbd8d
tester-mindset is a skill published in the GitHub repository n-n-code/n-n-code-skills (4 stars, last pushed 1mo ago), licensed MIT. It adds 88 tokens to every session and 2,150 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
verification-contract
Internal contract: one compact frozen ACCEPTANCE.md per delivery unit, its validation ladder, anti-weakening rules, and blob-bound execution receipt. Consumed by planners, execute-phase, and review-change.
pentest-api-attacker
Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.
pentest-container-k8s
Test Docker and Kubernetes security controls for RBAC abuse, breakout, and secret exposure.
pentest-remediation-validator
Retest remediated findings, detect regressions, and generate remediation status and certification artifacts.
pentest-vuln-analyzer
Correlate scanner results with CVE and exploit intelligence and prioritize by CVSS and exploitability.
web-api-tester
Test API endpoints for correctness, edge cases, auth handling, and OpenAPI contract compliance.