Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add summarybotng/summarybot-ng --skill risk-based-testinggit clone --depth 1 https://github.com/summarybotng/summarybot-ngWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/summarybotng/summarybot-ng/risk-based-testing)<a href="https://agentmods.dev/skills/summarybotng/summarybot-ng/risk-based-testing"><img src="https://agentmods.dev/badge/skills/summarybotng/summarybot-ng/risk-based-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/summarybotng/summarybot-ng/risk-based-testing"><img src="https://agentmods.dev/badge/skills/summarybotng/summarybot-ng/risk-based-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01614 |
| Opus 5 | $0.00016 | $0.00807 |
| Sonnet 5 | $0.00007 | $0.00323 |
| Haiku 4.5 | $0.00003 | $0.00161 |
Grade A, and why
risk-based-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Risk-Based Testing
<default_to_action> When planning tests or allocating testing resources:
- IDENTIFY risks: What can go wrong? What's the impact? What's the likelihood?
- CALCULATE risk: Risk = Probability × Impact (use 1-5 scale for each)
- PRIORITIZE: Critical (20+) → High (12-19) → Medium (6-11) → Low (1-5)
- ALLOCATE effort: 60% critical, 25% high, 10% medium, 5% low
- REASSESS continuously: New info, changes, production incidents
Quick Risk Assessment:
- Probability factors: Complexity, change frequency, developer experience, technical debt
- Impact factors: User count, revenue, safety, reputation, regulatory
- Dynamic adjustment: Production bugs increase risk; stable code decreases
Critical Success Factors:
- Test where bugs hurt most, not everywhere equally
- Risk is dynamic - reassess with new information
- Production data informs risk (shift-right feeds shift-left) </default_to_action>
Quick Reference Card
When to Use
- Planning sprint/release test strategy
- Deciding what to automate first
- Allocating limited testing time
- Justifying test coverage decisions
Risk Calculation
Risk Score = Probability (1-5) × Impact (1-5)
| Score | Priority | Effort | Action |
|---|---|---|---|
| 20-25 | Critical | 60% | Comprehensive testing, multiple techniques |
| 12-19 | High | 25% | Thorough testing, automation priority |
| 6-11 | Medium | 10% | Standard testing, basic automation |
| 1-5 | Low | 5% | Smoke test, exploratory only |
Probability Factors
| Factor | Low (1) | Medium (3) | High (5) |
|---|---|---|---|
| Complexity | Simple CRUD | Business logic | Algorithms, integrations |
| Change Rate | Stable 6+ months | Monthly changes | Weekly/daily changes |
| Developer Experience | Senior, domain expert | Mid-level | Junior, new to codebase |
| Technical Debt | Clean code | Some debt | Legacy, no tests |
Impact Factors
| Factor | Low (1) | Medium (3) | High (5) |
|---|---|---|---|
| Users Affected | Admin only | Department | All users |
| Revenue | None | Indirect | Direct (checkout) |
| Safety | Convenience | Data loss | Physical harm |
| Reputation | Internal | Industry | Public scandal |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 213 lines · 33 tokens per session scan A 72ab0c133601
risk-based-testing is a skill published in the GitHub repository summarybotng/summarybot-ng (2 stars, last pushed 3mo ago), licensed MIT. It adds 33 tokens to every session and 1,614 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Changelog Test Mapper
Map changelog entries and release notes to affected test cases, ensuring every user-facing change has corresponding test coverage verification.
Karma Testing
Comprehensive Karma test runner skill for browser-based JavaScript unit testing with Jasmine, Mocha, or QUnit frameworks, real browser execution, coverage reporting, and CI/CD pipeline integration.
AI Release Guardian
Analyze a git diff, map affected risks, select the tests that matter, detect coverage gaps on changed lines, run configurable quality gates, and produce a go/no-go release report with cited evidence. Recommends only; never merges or deploys.
Code Coverage Analysis
Measure and enforce test coverage with Istanbul/nyc, c8, Jest, and Vitest. Covers branch versus line coverage, per-directory thresholds, CI gates, and correctly excluding generated code from reports.
plugin-test
A testing guide for Zhin.js plugins using Vitest, a JavaScript and TypeScript testing framework. It focuses on checking command and tool behavior, ordinary business logic, and the plugin package’s required structure.
frontmcp-testing
Use for anything about testing FrontMCP servers: writing or running unit, integration, and E2E tests and reaching the 95%+ coverage bar. Covers Jest setup and coverage gating; unit-testing a ToolContext execute() with mock context, inputs, and Zod schema validation; testing resources and prompts; in-memory testing via…