Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/strands-compose/sdk-python/library-testingnpx skills add strands-compose/sdk-python --skill library-testinggit clone --depth 1 https://github.com/strands-compose/sdk-pythonWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.04387 |
| Opus 5 | $0.00031 | $0.02194 |
| Sonnet 5 | $0.00012 | $0.00877 |
| Haiku 4.5 | $0.00006 | $0.00439 |
Grade A, and why
library-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 335 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Library Testing
The testing doctrine for the strands-compose library (src/strands_compose/).
It defines what is worth testing, what is not, and how, so the suite stays
small, fast, trustworthy, and cheap to live with. It describes principles and
shapes, not a file list — resolvers, providers, and orchestration modes come and
go, the doctrine stays.
One sentence to internalise: a test exists to catch a real regression in behaviour, contract, or wiring — never to mirror the code, freeze its wording, or re-test strands. If a test can break when nothing a caller depends on changed, it is a liability, not an asset.
This library is a thin translator: YAML text → validated *Def data → live
strands objects. That single fact decides everything below. We do not own
Agent, Swarm, Graph, Model, MCPClient, or strands' hook events — so we
never test them and never mock them. We test our translation: that the right
config produces the right wired object, that bad config fails with the right
error, and that our runtime edges (streaming, guards, manifest) behave.
Read references/test-patterns.md for the concrete, copy-paste templates (owned
fakes, the resolve-seam patches, config builders, the wiring test, the contract
snapshot, property tests). This file is the law; that file is the toolbox —
load the toolbox only when you are actually writing a test.
Core Principles — NON-NEGOTIABLE
- Test behaviour, contracts, and wiring — never implementation. Assert on
what a caller observes: the type and wiring of the returned strands object,
the raised error type, the emitted
StreamEventsequence, the manifest shape. Never on private methods (_on_*), private attributes (_started,_errored), mock call counts/order, log lines, or human-readable messages. - Never mock what we don't own. strands, Pydantic, PyYAML and MCP internals
are off-limits as mock targets. Substitute a fake at our seam (a resolver,
a factory) — see Mocking Policy. Hand-built
MagicMockstrands events are forbidden. - Confidence per line is the metric. Optimise for the most regressions caught per test maintained — not coverage percentage, not test count. A smaller suite people trust beats a large one they ignore.
- A green suite means "safe to ship"; a red test means "something real broke." Anything that fails for innocuous reasons (a rename, a reorder, a reworded message) gets fixed or deleted, not tolerated.
- Determinism is mandatory. No real network, no real model calls, no MCP
subprocesses, no wall-clock waits, no
sleep, no shared mutable state, no ordering assumptions. Flaky is treated as broken. - Tests are read more than written — favour DAMP over DRY. Each test reads top-to-bottom as a small story: arrange a config, resolve it, assert the wiring. Clarity beats cleverness and reuse.
- Smallest reasonable test, at the lowest layer that can prove the rule. Pure transform → a unit/property test. Wiring → a resolver test. End-to-end shape → one pipeline test. Cover a rule once.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 335 lines · 62 tokens per session scan A 4814989ec64f
library-testing is a skill published in the GitHub repository strands-compose/sdk-python (5 stars, last pushed 17d ago), licensed Apache-2.0. It adds 62 tokens to every session and 4,387 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
browser-extension-patterns
Build browser extensions with Manifest V3 for Chrome, Firefox, and cross-browser compatibility. Covers content scripts, background workers, popup UI, storage APIs, and extension messaging. Triggers on browser extension development, Manifest V3, or Chrome extension requests.
ppt-translator
Amazon Bedrock 기반 PowerPoint(.pptx) 번역. 서식·레이아웃·차트 메타(제목/축 등)를 보존하며 텍스트를 한국어(ko) 등 대상 언어로 변환. CLI(python -m ppttranslator.cli)·SQLite 캐시·용어집· 원문 언어 자동 감지. PPT/슬라이드 번역, pptx 한국어, Bedrock 프레젠테이션 번역, batch translate, dry-run 비용 추정.
dev-app-assets
Generate icons, empty states, onboarding for apps.
marketer-localize-campaign
Localize a campaign across N markets.
ai-prompt-leaking
Systematically extract hidden system prompts, core directives, and invisible context intentionally concealed within Large Language Model (LLM) applications. This skill utilizes targeted linguistic engineering and boundary manipulation to bypass prompt opacity.
eks-design
Use when designing EKS architecture. Generates design documents with Mermaid diagrams, ADRs, security architecture, and validation reports. Translates requirements into tailored EKS designs guided by Well-Architected best practices. Covers cluster architecture, compute, networking, security, addons, observability…