Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TimothyHan/qa-buddy-skills --skill e2e-pomgit clone --depth 1 https://github.com/TimothyHan/qa-buddy-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timothyhan/qa-buddy-skills/e2e-pom)<a href="https://agentmods.dev/skills/timothyhan/qa-buddy-skills/e2e-pom"><img src="https://agentmods.dev/badge/skills/timothyhan/qa-buddy-skills/e2e-pom/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/timothyhan/qa-buddy-skills/e2e-pom"><img src="https://agentmods.dev/badge/skills/timothyhan/qa-buddy-skills/e2e-pom.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 131 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00159 | $0.02058 |
| Opus 5 | $0.00079 | $0.01029 |
| Sonnet 5 | $0.00032 | $0.00412 |
| Haiku 4.5 | $0.00016 | $0.00206 |
Grade A, and why
e2e-pom scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/qa-e2e-pom: Page Object Discovery & Healing
Two modes. Build is interactive — the user confirms what you discovered
(headless: the proof run — count 1, visible — is the confirmation; ambiguity is
flagged exactly as in Heal, never chosen).
Heal is autonomous — it repairs what drifted and flags what it can't.
Both read playwright/AUTOMATION.md (from /qa-e2e-setup) for POM style,
auth, and white-box mode. No AUTOMATION.md → run /qa-e2e-setup first.
Code standards: read {{REFERENCE_PATH}}/playwright-patterns.md before
writing POM code — POM templates, selector rules, and the exact-match /
scoping traps live there. Then the project learnings file (per the preamble)
— active LRN- entries scoped here override those patterns.
Constraints
- No locator without live proof. A selector enters the POM only after it was executed against the running app: resolves, expected count (1, or scoped n), visible. App unreachable mid-discovery → the unproven elements stay OUT of the POM and status is BLOCKED. Never write a plausible guess.
- Demand-driven inventory. Map only elements the given test cases touch. If asked to "map everything while you're there", decline and explain: unreferenced elements are unverifiable maintenance debt — they get mapped when a test case needs them.
- Selector priority:
getByTestId>getByRole(name)> label/placeholderCSS (last resort, marked
fragile: true). Never XPath. - Duplicates must be scoped, not indexed. If a locator matches >1 element
(hidden-but-attached ones count!), scope it to a parent (
row.getByTestId), don't.nth()it. Ambiguity the DOM can't resolve → ask the user (build) or flag (heal). - Name lookups are exact-match.
filter({ hasText: name })is substring matching — "Pliers" also matches "Combination Pliers". Row/card-by-name locators usefilter({ has: page.getByText(name, { exact: true }) }). (Caught live: wrong product clicked + strict-mode violation, 2026-08-07.) - The verification spec is the gate.
pom-verification.spec.tsmust be green before build/heal reports DONE. It is also the drift detector — keep it in the suite. It uses the same worker-indexed account fixtures as behavioral specs and self-seeds its own target data — never the config default storageState directly, which makes every worker authenticate as the same account and race under--repeat-each(caught live 2026-08-07). - Heal never touches healthy entries. Only entries whose verification failed may change. A "fix" to a passing locator is a defect.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +3 lines 4db6b74c33b1
- 10d ago First seen · 179 lines · 159 tokens per session scan A 69602b934d8c
e2e-pom is a skill published in the GitHub repository TimothyHan/qa-buddy-skills (9 stars, last pushed 2d ago), licensed Apache-2.0. It adds 159 tokens to every session and 2,058 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
qawolf-cli
Manage QA Wolf through the qawolf CLI. Use when asked to create, update, or list coverage requests, bug reports, or maintenance reports; start a run of flows or tags on the QA Wolf platform or read a run's results; list, set, or delete environment variables; manage environments, flows, or tags; request automation of…
test-review
A review checklist for newly written or changed automated tests using TypeScript and Playwright. Playwright is a tool for testing web browsers, and automated tests check software without repeating the steps by hand.
playwright-expert
Expert in Playwright E2E testing framework, auto-waiting mechanisms, test generation, trace viewer, and CI/CD integration. Use when the user mentions testing, end-to-end tests, QA, automation, end-to-end testing, or test automation, or when the task involves Playwright Framework, Test Organization, Advanced Features…
browser-test-executor
Execute approved bounded browser Test DSL cases with fresh isolated contexts and auditable attempts. Use when running browser tests, reruns, regression checks, or blocked execution diagnostics.
qa-tester
Coordinate a bounded, evidence-backed QA run from requirements through release recommendation. Use for end-to-end QA planning, execution, retests, regressions, or exploratory browser checks.
evidence-collector
Collect and validate redacted, immutable QA evidence and evidence gaps for browser attempts. Use when capturing screenshots, traces, logs, telemetry, or explaining unavailable evidence.