What is qa-evaluation?

A guide for evidence-based quality checks of software projects, features, and code changes. QA means checking that software behaves correctly and still meets its requirements.

Use it to assess UI, workflows, responsive behaviour, APIs, state, architecture, translations, recent code changes, and project quality, then produce a structured report.

It prevents broad quality claims without direct evidence and helps choose checks suited to acceptance, regression, delivery, or project health.

qa-evaluation — Skill by taichuy

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/taichuy/1flowbase/qa-evaluation

Any agent

npx skills add taichuy/1flowbase --skill qa-evaluation

Clone the repo

git clone --depth 1 https://github.com/taichuy/1flowbase

Made for: Claude Code, Codex.

Per session 146 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 5,363 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00146	$0.05363
Opus 5	$0.00073	$0.02681
Sonnet 5	$0.00029	$0.01073
Haiku 4.5	$0.00015	$0.00536

Measured 2d ago against content hash 5edb70e0a40b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-evaluation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/qa-evaluation/SKILL.md · 166 lines

How it starts

The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Evaluation

Overview

qa-evaluation 不是另一个开发 Skill，而是 1flowbase 的质量评估器。开发阶段默认不自动注入完整测试门禁；进入自检、验收、回归或交付阶段后，再由这个 Skill 负责选择脚本、收集证据并输出 QA 结论。它默认只产出问题报告与修正方向，不直接改代码。

质量门禁先分 lane 再选证据：开发后验收优先快，PR 门禁优先合并信心，项目体检优先完整健康快照和维护者感知。当前本地开发分支专注结果验证和尽早发现直接问题；仓库级、线上级、重型质量门禁默认交给 beta / CI / 专门质量工作区。不要把三种资源边界混成一套重门禁。

Project Health Gate 的顺序固定为：先确认 lane 和范围，再建立质量维度矩阵，再把脚本、artifact、日志、截图、代码证据归类到矩阵，最后输出 findings。当前失败脚本或错误报告只是证据来源，不得成为项目体检的完整范围或主线。

When to Use

功能完成后，需要对当前任务做质量回归
改了共享组件、共享状态或公共 API，需要检查变化传播
用户明确要求“全量评估项目现状代码”
需要输出结构化 QA 报告，而不是直接进入修复
需要判断 UI、流程、响应式、API、状态和架构边界是否仍然成立
需要评估后端接口、状态入口、插件消费边界、runtime 行为或工程质量门禁是否仍然符合最新规范
需要检查多语言 key / value、未引用 key、locale 文件名、翻译资源归属或 i18n-hygiene 报告
需要分析昨天/今天、近两天或近期代码热点、反复修改、churn 来源，并把问题转化为 AI 下次少犯错的 skills / AGENTS / 质量门禁 / 代码环境优化

不要用于

直接实现或修复功能
纯代码风格讨论
没有范围和验收场景的泛泛“看一眼”

The Iron Law

没有直接证据，不得下 QA 结论。默认只报告和 warning，不直接修；任何修复、删除或重构都必须得到用户明确同意。

用户可见文案是开发者已调好的产品内容，不是 QA 修复素材。除非用户在当前任务中明确要求改文案，否则 QA / i18n hygiene 不得修改任何展示给用户的字符串值；只能报告问题、复用既有 key、调整 key 引用、合并重复 key、删除确认失效 key，且必须保留原文案值。

Code Acceptance Checks

Dev Acceptance Gate 和 Project Health Gate 都必须把代码体检问题绑定到证据：文件 / 函数 / 调用点 / 运行路径 / 测试 / 日志 / 截图 / artifact。只凭“看起来复杂”不能下 finding；证据不足时写 未验证，不下确定结论。

Maintainability: 检查是否为了拆分而拆分、把完整业务流程拆成多个只调用一次的微型私有方法、引入无领域责任的 helper / utils / manager / adapter，或让主业务路径需要频繁跳转才读懂。单个方法超过约 80 行只是调查信号，不是自动 blocker；业务流程连贯且可读时不要强行要求拆分。
Error handling: 检查静默 fallback、默认值兜底、吞错、泛化错误、绕过逻辑和无业务语义防御代码。只有错误路径真实存在且符合当前边界时才建议错误处理；不应该发生的状态优先暴露问题、收敛状态来源或修正数据流。
Scope and boundary: 检查实现是否只覆盖已确认范围，是否顺手重构无关逻辑，是否为了局部方便破坏领域模型、状态模型、权限模型、contract 或前后端职责边界，是否把复杂度扩散到多个调用点或隐式约定里。
Test compatibility: 失败测试必须先对照当前 spec / ADR / 已确认验收预期 / 后端 DTO contract / 用户任务边界。旧测试不是兼容要求本身；若旧断言与新确认行为冲突，报告为过期测试期望或测试债，要求更新 / 删除对应测试证据，不得为了让旧测试通过添加 legacy alias、fallback、回退路径或弱化状态 / contract。无法证明新行为已被确认时，只能写 未验证，不下确定结论。
Acceptance point settlement: issue / handoff 有 AC-001 这类验收点时，QA 必须逐点给 green / red / 未验证、证据和残余风险；机械门禁通过只能作为证据，不能替代验收点结论。
Context capsule: 交付后若验收点通过，输出压缩 capsule：做了什么、在哪里、关键决策 / gotchas、后续扩展入口。capsule 只写指针，不复制代码；代码仓库仍是真值来源。
Quality rule change: 新增或调整 AGENTS / skills / repo hygiene / 质量门禁规则时，必须检查目标、验收证据、资源边界和停止条件；质量规则本身还要有反方样例、确定性 fixture 或历史证据、人工确认点。

Read the full file on GitHub · 166 lines

Files

What ships with it

27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 166 lines · 146 tokens per session scan A 5edb70e0a40b

Subscribe to this mod's changes

qa-evaluation is a skill published in the GitHub repository taichuy/1flowbase (259 stars, last pushed 3d ago), licensed Apache-2.0. It adds 146 tokens to every session and 5,363 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Git and workflow Localization Testing ai-gateway claude-api llm-gateway llm-orchestration self-hosted workflow-engine

localization-toolkit

This skill should be used when setting up, auditing, or enforcing internationalization/localization in UI codebases (React/TS, i18next or similar, JSON locales), including installing/configuring the i18n framework, replacing hard-coded strings, ensuring en-US/zh-CN coverage, mapping error codes to localized messages…

zebbern/claude-code-guide · 82 tokens

config-platform-change

Synchronizes config representations across router config, Python CLI schema, and dashboard config UI. Use when adding or changing a config concept that spans those surfaces or addressing config representation debt before Kubernetes-facing translation.

vllm-project/semantic-router · 43 tokens

n8n:content-design

Product content designer for UI copy. Use when writing, reviewing, or auditing user-facing text: button labels, error messages, tooltips, empty states, modal copy, placeholder text, confirmation dialogs, onboarding flows, or i18n strings. Also use when the user says /copy, /content, or /ux-copy.

n8n-io/n8n · 73 tokens

qa-evaluation