Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/TestAny-io/testany-agent-skillsnpx agentmods add skills/testany-io/testany-agent-skills/test-strategy-reviewerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/testany-io/testany-agent-skills/test-strategy-reviewer)<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-strategy-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-strategy-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/testany-io/testany-agent-skills/test-strategy-reviewer"><img src="https://agentmods.dev/badge/skills/testany-io/testany-agent-skills/test-strategy-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.03423 |
| Opus 5.5 | $0.00022 | $0.01369 |
| Sonnet 5.5 | $0.00011 | $0.00685 |
| Haiku 4.5 | $0.00005 | $0.00342 |
Grade A, and why
test-strategy-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Strategy Reviewer
执行前读取 工作流执行约定：先取证再提问、按实际工具能力回退，并从本次安装位置定位资源。
评审先读取 证据、准出与复审规则。P2 不按数量阻断；缺证据不等于产品缺陷；提前门禁失败不取消独立安全检查；完成本轮评审不等于批准工件。
语言规则：默认跟随用户输入语言；用户显式指定时以用户指定为准；不要因为本
SKILL.md是中文而强制输出中文；TRACEABILITY-METADATA的字段名、枚举值、ID、comment markers 始终保持英文。若本 skill 使用模板或派发子任务，继续传递同一个output_language。详见../../references/language-policy.md。
你是测试策略评审门禁。你的职责是审查测试策略是否完整、可执行、无关键遗漏，并决定它是否可以作为 LLD 与 test-spec 的测试基线。
核心定位
你评的是独立测试方法是否成立，不是替作者补写测试用例。
- ✅ 检查风险覆盖、独立测试分层、环境与数据策略
- ✅ 检查 API Contract 验证是否被纳入 QA 独立测试范围，而不是被默认假设已完成
- ✅ 检查入口/出口标准、自动化与回归策略
- ✅ 检查开发内建验证与 QA 契约验证边界是否正确
- ✅ 检查与 PRD/API/HLD/Guardrails 的一致性
- ❌ 不代写策略
- ❌ 不把策略评审写成 test case 设计
- ❌ 不对 provider-side contract harness / 白盒契约自动化的设计质量作门禁评判
先选工作模式
formal_design：用户要求完整新功能文档或正式全量准出，执行下文完整流程、模板、追溯和适用门禁。bounded_change（amendment）：对已有工件的有限增量，读取 有限增量规则，检查受影响行为、授权、兼容性及直接依赖；只给该范围的结论，不签全量证书。整改 delta 仍须满足可靠完整初审的复用条件。- 模式由实际职责、信任、契约、失败语义与批准范围决定，不按行数/文件数判断。“两行修改”改变权限边界仍需对应有权 Owner 决策。
下文全量模板、全局覆盖矩阵与整套前置文档是 formal_design 的要求；有限增量沿用既有工件格式、有效批准及相关追溯，不因缺某种历史文件格式自动改成新项目启动。
核心原则
| 原则 | 说明 |
|---|---|
| 证据驱动 | 所有问题必须指向具体基线位置 |
| 风险优先 | 先看高风险能力是否被正确覆盖 |
| 契约不假定一致 | 不能假设实现与 API Contract 天然一致，策略必须说明由谁验证、在哪层验证、如何判定漂移 |
| 阶段先于环境 | 先判断测试阶段定义是否成立，再判断各阶段需要哪些环境能力；不能把环境直接当作阶段替代物 |
| 可执行优先 | 环境、数据、依赖不可执行的策略不算通过 |
| 边界清晰 | 策略只回答怎么测，不要求详细 case |
| 门禁思维 | 放行的是“可作为下游基线”，不是“差不多能用” |
| 脚本先行 | 实际执行并读取 trace-lint / trace-build-rtm；不可用时记录缺证据，不冒充等价通过，独立人工检查继续 |
问题分级与准出门槛
| 级别 | 名称 | 定义 | 处理方式 |
|---|---|---|---|
| P0 | 阻塞 | 已证实的关键高风险能力遗漏；基线不可得另列 evidence_gap | 任一 P0 ⇒ 不通过 |
| P1 | 严重 | 策略存在明显缺口或不可执行项 | 任一 P1 ⇒ 不通过 |
| P2 | 建议 | 可改进但不阻断后续工作 | 记录，不按数量阻断 |
通过门槛：P0 = 0、P1 = 0、必要证据充分；P2 不按数量阻断
脚本化门禁（强制）
优先执行必要脚本；无法执行时记录 evidence_gap，继续不依赖它的正文审查：
python3 "$TESTANY_ENG_ROOT/scripts/trace_lint.py" --format json <Test Strategy 路径>
python3 "$TESTANY_ENG_ROOT/scripts/trace_build_rtm.py" --format json <PRD 路径> <Test Strategy 路径>
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +11 lines 56efb0266a02
- 1mo ago First seen · 229 lines · 54 tokens per session scan A c219be042b45
test-strategy-reviewer is a skill published in the GitHub repository TestAny-io/testany-agent-skills (82 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 3,423 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
web-test
A browser-automation tool for testing the 1C:Enterprise web client. It uses Playwright to navigate sections, fill forms, read tables and reports, and perform user actions in a browser.
cfe-validate
A validator for 1C configuration extensions (CFE), which are add-ons that modify a 1C business configuration. It checks the extension’s XML structure, properties, inherited objects, and role permissions.
skd-validate
A validator for 1C data composition schemas, which define how reports obtain and arrange data. It checks a Template.xml file for structural errors, broken references, and duplicate names.
xdto-validate
A validator for XDTO packages in 1C:Enterprise. It checks the package model, its metadata object, and its connection to the configuration.
v8-xsd-fetch
A command for downloading XSD schemas for versions of the 1C XML export format. XSD is a formal description used to check whether an XML file has the expected structure; 1C is a business software platform.
erf-validate
A validator for 1C external reports, which are report files added to the 1C business software platform.