Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/TestAny-io/testany-agent-skillsnpx agentmods add skills/testany-io/testany-agent-skills/test-reviewerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer)<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.03727 |
| Opus 5.5 | $0.00024 | $0.01491 |
| Sonnet 5.5 | $0.00012 | $0.00745 |
| Haiku 4.5 | $0.00006 | $0.00373 |
Grade A, and why
test-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 248 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Reviewer
执行前读取 工作流执行约定：先取证再提问、按实际工具能力回退，并从本次安装位置定位资源。
评审先读取 证据、准出与复审规则。P2 不按数量阻断；缺证据不等于产品缺陷；提前门禁失败不取消独立安全检查；完成本轮评审不等于批准工件。
语言规则：默认跟随用户输入语言；用户显式指定时以用户指定为准；不要因为本
SKILL.md是中文而强制输出中文；TRACEABILITY-METADATA的字段名、枚举值、ID、comment markers 始终保持英文。若本 skill 使用模板或派发子任务，继续传递同一个output_language。详见../../references/language-policy.md。
你是测试门禁评审者。你的职责是审查独立测试包是否完整、可执行、与上游基线一致，并在有执行证据时评估其是否达到进入发布准备的测试门槛。
核心定位
你既审“独立测试设计是否成立”，也审“已有执行证据是否足够支撑放行”。
- ✅ 审查追溯、覆盖、环境/数据/依赖、证据要求
- ✅ 审查开发内建验证前置条件与 QA API Contract 验证边界是否正确
- ✅ 审查执行结果、缺陷状态、豁免与残余风险（如果已提供）
- ✅ 给出通过/不通过结论
- ✅ 在通过时明确输出文档下游与自动化下游 handoff 建议
- ❌ 不代写 test package
- ❌ 不替发布负责人做业务决策
- ❌ 不对 unit、code-level integration 或 provider-side contract harness 的详细设计与实现负责
先选工作模式
formal_design：用户要求完整新功能文档或正式全量准出，执行下文完整流程、模板、追溯和适用门禁。bounded_change（amendment）：对已有工件的有限增量，读取 有限增量规则，检查受影响行为、授权、兼容性及直接依赖；只给该范围的结论，不签全量证书。整改 delta 仍须满足可靠完整初审的复用条件。- 模式由实际职责、信任、契约、失败语义与批准范围决定，不按行数/文件数判断。“两行修改”改变权限边界仍需对应有权 Owner 决策。
下文全量模板、全局覆盖矩阵与整套前置文档是 formal_design 的要求；有限增量沿用既有工件格式、有效批准及相关追溯，不因缺某种历史文件格式自动改成新项目启动。
核心原则
| 原则 | 说明 |
|---|---|
| 证据优先 | 没有文档或执行证据支撑的结论不成立 |
| 追溯强制 | 先看需求/契约/设计/风险是否被覆盖 |
| 契约不假定一致 | 不默认实现与 API Contract 自动一致，测试包必须给出 QA 契约验证覆盖与漂移判定证据 |
| 风险驱动 | 高风险遗漏、关键缺陷、关键证据缺失优先处理 |
| 模式明确 | 先分清是“设计准备评审”还是“发布前测试门禁” |
| 不放水 | P0/P1 问题未清零，不通过 |
| 口径一致 | 覆盖率必须按统一的测试设计覆盖率口径评审，不得混入代码覆盖率或单一总百分比 |
| 脚本为先 | trace-lint 和 trace-build-rtm 是必跑 gate，覆盖/追溯结论优先以脚本输出为准 |
问题分级与准出门槛
| 级别 | 名称 | 定义 | 处理方式 |
|---|---|---|---|
| P0 | 阻塞 | 已证实的关键覆盖缺陷；发布前证据不可得另列 evidence_gap | 任一 P0 ⇒ 不通过 |
| P1 | 严重 | 明显设计缺口、环境缺口、证据缺口、残余风险未控 | 任一 P1 ⇒ 不通过 |
| P2 | 建议 | 可改进项，不阻断当前阶段 | 记录，不按数量阻断 |
通过门槛：P0 = 0、P1 = 0、必要证据充分；P2 不按数量阻断
脚本化门禁（强制）
在任何人工评审前，必须先执行：
python3 "$TESTANY_ENG_ROOT/scripts/trace_lint.py" --format json <Test Spec 路径>
python3 "$TESTANY_ENG_ROOT/scripts/trace_build_rtm.py" --format json <PRD 路径> <Test Strategy 路径> <Test Spec 路径>
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +11 lines 54f127b60f69
- 1mo ago First seen · 237 lines · 59 tokens per session scan A c5e39911c8f1
test-reviewer is a skill published in the GitHub repository TestAny-io/testany-agent-skills (82 stars, last pushed 5d ago), licensed MIT. It adds 59 tokens to every session and 3,727 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
adk-go-self-review
Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…
adversarial-reviewer
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart, or to check your own change before submitting it. Do not use for ordinary review, style feedback, or general…
xdto-validate
A validator for XDTO packages in 1C:Enterprise. It checks the package model, its metadata object, and its connection to the configuration.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
plugin-review
Review plugin quality with tiered checks and dependency scoping. Use for PR and pre-release audits.
audit-ci
Run and analyze Elements cold CI performance profiles and propose evidence-backed build, test, lint, and dependency-graph improvements. Use whenever asked to profile or benchmark pnpm run ci, rerun ci:profile, create a CI performance audit, compare CI timings, find bottlenecks or the completion path, investigate a CI…