Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sdcorejs/sdcorejs-agent/sdcorejs-testnpx skills add sdcorejs/sdcorejs-agent --skill sdcorejs-testgit clone --depth 1 https://github.com/sdcorejs/sdcorejs-agentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00086 | $0.02817 |
| Opus 5 | $0.00043 | $0.01409 |
| Sonnet 5 | $0.00017 | $0.00563 |
| Haiku 4.5 | $0.00009 | $0.00282 |
Grade A, and why
sdcorejs-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 242 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Track
Purpose and ownership
Own test planning, test authoring, safe execution, coverage matrices, UAT cases,
RED-first TDD, authenticated runner evidence, and UI capture verification.
sdcorejs-debug owns root-cause investigation and production bug fixes.
sdcorejs-documentation owns guide prose and image placement. This skill must
not invoke Git, call sdcorejs-git, install dependencies, or start/modify a
runtime unless the current request explicitly authorizes that exact action.
Shared protocols
- Read
_refs/shared/runtime-protocols.md, then_refs/shared/tasklist.mdfor non-trivial work and_refs/shared/persona.mdwhen present. - Apply Project Context Preflight v2 from
_refs/shared/project-context.md. Current request, files, diff, requirements, command output, and test failures override stored context. Missing or stale summary never blocks testing and does not authorize a refresh. Continue with targeted reads or a scoped code map. - Apply
_refs/shared/artifact-lifecycle.mdwhenever evidence or documentation assets are created; returnartifact_context. - Apply
_refs/shared/user-choice-prompt.mdbefore presenting approval or mode choices. - Localize runtime-facing prose to the user's language. Keep schema keys, commands, identifiers, and canonical source English.
Step 1 - Classify the action
Pick exactly one public action:
test_action |
Boundary |
|---|---|
run-only |
Discover and run existing commands; no edits. |
write-tests |
Edit scoped tests/fixtures; discovery only, no run. |
write-and-run |
Edit scoped tests, then run focused discovered commands. |
test-plan-readonly |
Read-only risk, case, and command plan. |
coverage-audit |
Read-only current coverage and requirement gaps unless tests are requested. |
uat-cases |
Produce requested UAT cases/checklists; no source implementation. |
tdd-red |
Write the smallest failing test and prove RED; no production code. |
tdd-cycle |
RED, minimal GREEN implementation, then refactor and verify. |
failing-output-triage |
Explain/classify sanitized output without edits. |
debug-handoff |
Stop and transfer fix/root-cause work to sdcorejs-debug. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 242 lines · 86 tokens per session scan A 9e3e1a9e0ade
sdcorejs-test is a skill published in the GitHub repository sdcorejs/sdcorejs-agent (2 stars, last pushed 15d ago), licensed MIT. It adds 86 tokens to every session and 2,817 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-integration
Run all three agent integration phases sequentially: research, write-tests, and implement using E2E-first TDD (unit tests written last). For individual phases, use /agent-integration:research, /agent-integration:write-tests, or /agent-integration:implement. Use when the user says "integrate agent", "add agent…
e2e
Write and run web E2E tests (Playwright) using TDD — locations, patterns, commands, and debugging.
tdd-workflow (测试驱动开发工作流)
在编写新功能、修复 Bug 或重构代码时使用此技能。强制执行测试驱动开发 (TDD)，包括单元测试、集成测试和端到端 (E2E) 测试，确保覆盖率达到 80% 以上。.
writing-system-tests
Use BEFORE implementing any feature that has stories in .docs/stories/ — generates failing acceptance specs from acceptance criteria as the RED phase of TDD. Generates HTTP/request-level acceptance tests for headless/API projects, end-to-end UI tests for projects with a frontend, using the project's own test framework…
ccc-e2e
CC Commander · $ccc-e2e · Full-surface confidence before you ship.
mushi-integration
Full end-to-end Mushi Mushi integration smoke test: bug capture → AI triage → story mapping → TDD test generation → approval → execution → PDCA cycle. Use when "test mushi integration", "verify full pipeline", "mushi e2e check", "does mushi work end-to-end", "smoke test mushi", or after deploying changes.