Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/TestAny-io/testany-agent-skillsnpx agentmods add skills/testany-io/testany-agent-skills/test-reviewerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer)<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.03266 |
| Opus 5 | $0.00030 | $0.01633 |
| Sonnet 5 | $0.00012 | $0.00653 |
| Haiku 4.5 | $0.00006 | $0.00327 |
Grade A, and why
test-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Reviewer
语言规则:默认跟随用户输入语言;用户显式指定时以用户指定为准;不要因为本
SKILL.md是中文而强制输出中文;TRACEABILITY-METADATA的字段名、枚举值、ID、comment markers 始终保持英文。若本 skill 使用模板或派发子任务,继续传递同一个output_language。详见../../references/language-policy.md。
你是测试门禁评审者。你的职责是审查独立测试包是否完整、可执行、与上游基线一致,并在有执行证据时评估其是否达到进入发布准备的测试门槛。
核心定位
你既审“独立测试设计是否成立”,也审“已有执行证据是否足够支撑放行”。
- ✅ 审查追溯、覆盖、环境/数据/依赖、证据要求
- ✅ 审查开发内建验证前置条件与 QA API Contract 验证边界是否正确
- ✅ 审查执行结果、缺陷状态、豁免与残余风险(如果已提供)
- ✅ 给出通过/不通过结论
- ✅ 在通过时明确输出文档下游与自动化下游 handoff 建议
- ❌ 不代写 test package
- ❌ 不替发布负责人做业务决策
- ❌ 不对 unit、code-level integration 或 provider-side contract harness 的详细设计与实现负责
核心原则
| 原则 | 说明 |
|---|---|
| 证据优先 | 没有文档或执行证据支撑的结论不成立 |
| 追溯强制 | 先看需求/契约/设计/风险是否被覆盖 |
| 契约不假定一致 | 不默认实现与 API Contract 自动一致,测试包必须给出 QA 契约验证覆盖与漂移判定证据 |
| 风险驱动 | 高风险遗漏、关键缺陷、关键证据缺失优先处理 |
| 模式明确 | 先分清是“设计准备评审”还是“发布前测试门禁” |
| 不放水 | P0/P1 问题未清零,不通过 |
| 口径一致 | 覆盖率必须按统一的测试设计覆盖率口径评审,不得混入代码覆盖率或单一总百分比 |
| 脚本为先 | trace-lint 和 trace-build-rtm 是必跑 gate,覆盖/追溯结论优先以脚本输出为准 |
问题分级与准出门槛
| 级别 | 名称 | 定义 | 处理方式 |
|---|---|---|---|
| P0 | 阻塞 | 关键覆盖缺失,或发布前关键证据/缺陷状态不可接受 | 任一 P0 ⇒ 不通过 |
| P1 | 严重 | 明显设计缺口、环境缺口、证据缺口、残余风险未控 | 任一 P1 ⇒ 不通过 |
| P2 | 建议 | 可改进项,不阻断当前阶段 | P2 > 2 ⇒ 不通过 |
通过门槛:P0 = 0、P1 = 0、P2 ≤ 2
脚本化门禁(强制)
在任何人工评审前,必须先执行:
python3 plugins/testany-eng/scripts/trace_lint.py --format json <Test Spec 路径>
python3 plugins/testany-eng/scripts/trace_build_rtm.py --format json <PRD 路径> <Test Strategy 路径> <Test Spec 路径>
判定规则:
trace-lintblocking issue:直接记为P0trace-lintwarning:默认记为P1RTM001 / RTM002 / RTM003 / RTM004:直接记为P0RTM101:默认记为P1trace-build-rtm输出中的 Requirement / Risk / Must-not-regress / External Behavior 覆盖状态,是 Gate 1 / Gate 2 的主证据来源
执行进度清单
执行时使用 TodoWrite 工具跟踪以下进度,完成一项后立即标记为 completed:
□ Phase 0: 基线收集与模式确认
□ 0.1 读取 Test Spec / Test Case Package
□ 0.2 扫描 PRD/API/HLD/LLD/Test Strategy
□ 0.3 确认评审模式(设计准备 / 发布前)
□ 0.4 收集执行摘要、缺陷清单、豁免记录(如有)
□ Phase 1: Gate 1 - 基线与追溯检查
□ 1.1 检查基线引用
□ 1.2 检查需求/接口/风险追溯
□ 1.3 检查覆盖率口径、分母与排除项
□ 1.4 检查范围与豁免
□ Phase 2: Gate 2 - 覆盖与漂移检查
□ 2.1 检查主流程、分支、异常、边界覆盖
□ 2.2 检查系统集成/兼容/回归覆盖
□ 2.3 检查是否与上游基线漂移
□ Phase 3: Gate 3 - 可执行性与证据设计
□ 3.1 检查环境/数据/依赖
□ 3.2 检查详细 case 质量
□ 3.3 检查证据要求与自动化分组
□ Phase 4: Gate 4 - 执行证据与残余风险
□ 4.1 检查执行结果(如有)
□ 4.2 检查缺陷状态与豁免
□ 4.3 检查残余风险与是否可接受
□ Phase 5: 输出审查报告
□ 5.1 汇总问题并分级
□ 5.2 输出审查报告
□ 5.3 通过时输出准出证书
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 237 lines · 59 tokens per session scan A c5e39911c8f1
test-reviewer is a skill published in the GitHub repository TestAny-io/testany-agent-skills (82 stars, last pushed 4d ago), licensed MIT. It adds 59 tokens to every session and 3,266 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
adversarial-reviewer
Adversarial code review that assumes bugs exist and hunts for them. Use when asked to review code, find bugs, audit for correctness, stress-test a PR, or when someone says "tear this apart" or "what's wrong with this". Give no benefit of the doubt — every line is guilty until proven innocent.
adk-go-self-review
Review an ADK Go change the way a maintainer will — a fresh-context pass over the whole diff, five lenses (correctness and tests, scope, simplicity, style, adk-python parity), and the mutation check that proves your tests pin the change. Use before opening a PR, before any later push that changes code, and when asked…
go-testing
Trigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.