Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tobihagemann/turbo --skill smoke-testgit clone --depth 1 https://github.com/tobihagemann/turboWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tobihagemann/turbo/smoke-test)<a href="https://agentmods.dev/skills/tobihagemann/turbo/smoke-test"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/smoke-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tobihagemann/turbo/smoke-test"><img src="https://agentmods.dev/badge/skills/tobihagemann/turbo/smoke-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02973 |
| Opus 5.5 | $0.00035 | $0.01189 |
| Sonnet 5.5 | $0.00018 | $0.00595 |
| Haiku 4.5 | $0.00009 | $0.00297 |
Grade A, and why
smoke-test scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smoke Test
Launch the app and hands-on verify that it works by interacting with it. Every smoke test is a concrete interaction with the running app: navigating a screen, clicking a control, filling a form, running a CLI command, and observing the result.
Step 1: Determine Scope
Resolve scope using the first match:
- User-specified — the user says what to test. Use that.
- PR — a PR URL or number is provided. Fetch the PR details (title, description, changed files, comments) and read the changed code.
- Conversation context — prior conversation contains recent work (a feature, fix, or refactor). Extract what changed, where it lives, and expected behavior.
- App-level discovery — fresh context with no prior work. Examine the project (entry points, routes, commands, README) to identify the app's core user-facing flows. Design tests that verify the app launches and its primary functionality works end-to-end.
Step 2: Determine Testing Approach
Always check for project-specific testing skills or MCP tools first. Use the fallbacks below when nothing project-specific is available:
- Web app →
/agent-browserskill if available, otherwiseclaude-in-chromeMCP - UI/native app →
computer-useMCP - CLI tool → direct terminal execution
- Library with no entry point → report that smoke testing is not applicable and stop, unless the scope changes a check's configuration; then use direct terminal execution
Step 3: Run /test-run-rules Skill
Run the /test-run-rules skill to load the rules for launching and driving the app.
Step 4: Plan Smoke Tests
Before drafting tests, check whether there is something to exercise:
- The scope changes a check's configuration (linter, formatter, type checker, or CI gate rules) — for that part of the scope, the check itself is the surface; plan tests against it and run them via the CLI Path in Step 5. Export the tree carrying the change to a scratch directory outside the checkout, add input there that each changed rule should flag or accept, and run the check on it. Pair each case with the same input under the configuration at the ref the resolved scope is measured against as its control, so a verdict the old configuration also produces is not credited to the change. Write the control configuration into the exported tree beside the configuration it stands in for. Credit a run's verdict only when the check processed a nonzero number of inputs; otherwise fix its setup and rerun, and report the case inconclusive only when no fix gets the check to process any input. Reach the check's installed toolchain and plugins from the scratch directory without installing into or modifying the checkout; when the check cannot run there, report the case unverified. When the change adds or narrows a suppression and the check reports unused suppressions, add a case with the suppressed cause removed and confirm the check reports the stale suppression.
- No user-visible change in the resolved scope — look for an existing integration test target that covers the change and is not part of the default test suite (so it hasn't already run in this session). If one exists, run it via the Integration Test Path in Step 5. If nothing exists, report that there is no interactive surface to verify and no separate integration suite to fall back on, then stop.
- Required infrastructure cannot be stood up in this session (backend service, auth provider, external dependency) — look for a stub under the test run rules before reporting blocked. When a stub works, record its response shapes and state transitions in the Setup contract's Mock boundaries item, along with the re-install condition for a call-site stub, and the PID and port of any stub process in Owned cleanup, then carry on with the plan. When the rules leave the scenario blocked, report blocked, naming what is missing and what was tried, then stop.
- A test needs privileged state or a second participant (an entitlement or plan tier, an elevated role, seed data, a second concurrent client or session) — provision it under the test run rules. Keep the test in the plan once provisioning succeeds, and record the granted state in the Setup contract's Test identity item and every session, role, and record this run creates in Owned cleanup. Drop the test to unverified only after an attempt failed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed bb1d8573ae16
- 26d ago Changed f08cde0082b8
- 28d ago Changed · -7 lines 7187aeac5dd7
- 1mo ago Changed · +11 lines 4d42743500f4
- 1mo ago Changed · +2 lines 6c5e0ae526fb
- 1mo ago Changed 53c42b4f122b
- 1mo ago Changed · +1 lines 028188578d70
- 1mo ago Changed 2f9091f1184d
- 1mo ago Changed · +2 lines 665198580bdf
- 1mo ago First seen · 163 lines · 88 tokens per session scan A 42abfec510e4
smoke-test is a skill published in the GitHub repository tobihagemann/turbo (416 stars, last pushed 3d ago), licensed MIT. It adds 88 tokens to every session and 2,973 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
e2e-playwright
Use when writing end-to-end browser tests with Playwright. Covers resilient locators, auto-waiting, network interception, authentication reuse, parallelization, and eliminating flakiness. Trigger on "write playwright tests", "e2e test is flaky", "replace our cypress suite", "reuse login state in playwright". Do not…
test-strategy
Use when deciding what to test and at which level. Covers the test pyramid, what belongs in unit versus integration versus end-to-end tests, coverage as a signal rather than a target, and eliminating flakiness. Trigger on "what should we test", "our test suite is slow and flaky", "unit or integration test", "what…
visual-qa
Use when verifying that a UI renders correctly. Covers visual regression testing, responsive checks across breakpoints, cross-browser verification, and screenshot-based review of an implementation against a design. Trigger on "does this match the figma", "set up screenshot tests", "layout breaks on mobile", "looks…
web-app-testing
Use when testing a web application interactively — verifying a feature, reproducing a bug, or checking a flow in a real browser. Covers systematic exploration, console and network inspection, and reporting what you find. Trigger on "check this works in the browser", "reproduce this bug", "click through the signup…
test-writer
Write thorough tests following TDD and BDD principles.
security-regression-tests
Turning a confirmed and fixed finding into a permanent guard: proving the test fails without the fix, asserting the effect and not only the status code, seeding the two principals an authorization test needs, making a timing or out-of-band proof deterministic enough for CI, and keeping the test in a job that can…