Borrowing it
Nothing to install: this file belongs to taichuy/1flowbase. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/taichuy/1flowbase/main/.agents/skills/qa-evaluation/SKILL.mdgit clone --depth 1 https://github.com/taichuy/1flowbaseWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/taichuy/1flowbase/qa-evaluation)<a href="https://agentmods.dev/skills/taichuy/1flowbase/qa-evaluation"><img src="https://agentmods.dev/badge/skills/taichuy/1flowbase/qa-evaluation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/taichuy/1flowbase/qa-evaluation"><img src="https://agentmods.dev/badge/skills/taichuy/1flowbase/qa-evaluation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02334 |
| Opus 5.5 | $0.00027 | $0.00934 |
| Sonnet 5.5 | $0.00014 | $0.00467 |
| Haiku 4.5 | $0.00007 | $0.00233 |
Grade A, and why
qa-evaluation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Evaluation
Outcome and Authority
独立判断实现是否满足目标与架构边界，不能只复述开发者说明或测试绿灯。QA 负责取证与结论，默认不修改产品；已有修复授权可由对应开发 skill 承接，不重复申请同一授权，也不扩张到未授权清理。
当前任务的目标 / AC、设计和架构约束、源码与行为证据分别承担不同职责。文档与实现冲突时定位偏离及影响，不把改文档、改测试或改产品视为自动获准。
Architecture Baseline
先取得本次所需的架构认知，再检查实际调用与效果；不要求先读全局架构或所有专项。
| 范围 | 规范真值与阅读路径 | 核对实际实现 |
|---|---|---|
| 前端 | DESIGN.md 的真值 / 视觉层及相关章节；web/AGENTS.md 与最近局部规则 | 页面任务、详情模型、状态 / 权限消费、组件与样式 owner |
| 后端 | api/AGENTS.md；调用架构 总览及相关主题；crate 变化查 crates/AGENTS.md | Protocol → Canonical Interface / 冻结计划 → typed Handler → Business / Execution；调用图不冒充 Cargo 依赖图 |
| 跨前后端 | 后端 DTO / interface 与已确认用户流程 | 字段原名、授权与业务真值 owner、真实消费者，不以 UI 隐藏证明 API 权限 |
| 规则 / tooling | 当前规则 owner、调用入口、历史失败及合法反例 | 能否识别目标失败且不误伤合法任务；不因文档改动启动产品门禁 |
架构符合性与行为正确性分别结算：测试通过不能证明未绕过 Kernel / owner；源码符合架构也不能证明运行行为通过。源码可证明具体依赖或调用越界，运行后果若未取证则注明限制。
Code Acceptance Checks
C = 本次验收目标 ∪ 适用架构约束 ∪ 直接传播风险
R = {规则 r | r 与 C 相关}
结论(c) ∈ {通过, 失败, 未验证}，c ∈ C
C 是本次应评估事项，R 是需读取的规则；项目体检的 C 来自完整质量维度矩阵，不能被局部 diff 限缩。逐项寻找证据，不因名字相似加载全部专项。
- finding 绑定规则来源、具体位置 / 调用链、证据与影响，并检查合法反例；命名、行数或主观复杂度仅是调查信号。
- 维护性检查聚焦真实职责与复杂度传播；单调用方层承担事务、权限或错误映射时不算空转抽象。方法长不自动阻断。
- 核对静默 fallback、吞错、泛化错误和重复防御是否违背当前 contract；不把新增兼容层当作默认修复。
- 失败先归因产品回归、contract 破坏、fixture / 环境故障或过期预期。旧测试不自动构成兼容要求，不能为收绿弱化当前 contract。
existing-codebase只把本次引入 / 触发或已纳入范围的问题作为 blocker；既有债默认 warning。证据不足写未验证，不下确定结论。- QA / i18n 清理不得顺手改变用户可见文案值；用户明确授权的文案变更按任务处理。临时字段兼容沿用项目
@field-contract-compat规则及 warning，不新增展示字段别名。
Lane and Evidence
默认 Dev Acceptance；按 gate-lanes 区分任务验收、PR 合并门禁与项目体检，遇到模式歧义再查 modes。
- Dev Acceptance：当前目标与直接风险，复用有效证据，补缺口；不自动跑全仓门禁。
- PR Merge：使用对应候选的 CI / artifact；本地通过不冒充远端门禁通过。
- Project Health：先用 project-evaluation-checklist 建质量维度矩阵，再归类证据与风险；单个失败脚本不代表体检全范围。
- Issue Tree：遵循 long-running-work，全部产品与 fixture 装配冻结后由一个 fresh QA 集中验收，不做 per-packet QA。一次返回全部 blocker，修复后只补受影响证据；语义 / 范围变化或同根因第二次失败回到 Root 定界。
- 执行成本、并发、资源失败转向、日志和证据失效条件统一使用 test-driven-development。换 agent 或进入收尾不自动使证据失效；编译、零用例与未完成链接不算行为测试通过。
- 四基座需要对应 candidate-bound receipt，通用 tooling green 不替代；资源限制触发时停止该验证路径并列出缺口，不宣布验收通过。
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/audit/algorithms-state-concurrency.md 3.2 KB
- references/audit/code-audit-model.md 4.4 KB
- references/audit/database-query-ephemeral.md 3.5 KB
- references/audit/foundation-audit-cards.md 5.4 KB
- references/audit/observability-log-pipeline.md 3.2 KB
- references/audit/test-asset-lifecycle.md 3.3 KB
- references/backend/backend-regression-steps.md 8.7 KB
- references/backend/builtin-data-model-contract-gate.md 3.6 KB
- references/backend/console-settings-registration-gate.md 4.1 KB
- references/backend/interface-lifecycle-gate.md 3.6 KB
- references/backend/rust-backend-quality-gates.md 6.0 KB
- references/backend/scope-id-routing.md 1.9 KB
- references/frontend/frontend-quality-gates.md 6.3 KB
- references/frontend/i18n-hygiene-gate.md 3.2 KB
- references/governance/anti-patterns.md 2.0 KB
- references/governance/foundation-contract-gates.md 4.7 KB
- references/governance/gate-lanes.md 6.5 KB
- references/governance/hotspot-prevention.md 2.1 KB
- references/governance/maintainability-dead-abstraction.md 4.7 KB
- references/governance/modes.md 2.1 KB
- references/governance/project-evaluation-checklist.md 5.7 KB
- references/governance/quality-gate-watch.md 5.8 KB
- references/governance/repo-quality-gates.md 11 KB
- references/governance/report-template.md 2.9 KB
- references/governance/severity-rules.md 3.9 KB
- references/governance/task-mode-checklist.md 7.9 KB
- references/security/container-image-security.md 5.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed 9816b28cd9e9
- 1mo ago Changed · -80 lines · -78 tokens per session e6f41e52a03a
- 2mo ago First seen · 166 lines · 146 tokens per session scan A 5edb70e0a40b
qa-evaluation is a skill published in the GitHub repository taichuy/1flowbase (284 stars, last pushed today), licensed Apache-2.0. It adds 68 tokens to every session and 2,334 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
unified-ai-gateway
Operate and evaluate Unified AI System through fifteen governed MCP tools, including provider-free prompt enhancement, while preserving fake-provider, authorization, and evidence boundaries.
cli-eval
Create and run evaluation suites, watch live benchmark progress, view scorecards, compare model performance, and integrate eval runs with CI workflows from the CLI.
quality-scan
Run a scoped, read-only quality scan and report exact-candidate evidence, failures and frozen debt. Use for an ad-hoc gate sweep or release preparation; a static scan is not full release acceptance.
sweep-reds
Repair confirmed CI failures base-first, then prepare affected PRs one at a time with exact-candidate evidence. Use when asked to sweep reds or restore the queue. Never merges, closes PRs, weakens tests, or changes CI under ordinary sweep authority.
validate-release-green
Run or inspect the local Release-Green observer for an exact base or combined PR candidate, separating hard failures, advisory drift and incomplete evidence. Use for maintainer preflight; full CI acceptance remains a separate requirement.
qa
General-purpose QA verdict for any artifact type.