Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add upex-galaxy/agentic-qa-boilerplate --skill project-discoverygit clone --depth 1 https://github.com/upex-galaxy/agentic-qa-boilerplateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/project-discovery)<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/project-discovery"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/project-discovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/project-discovery"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/project-discovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00121 | $0.07636 |
| Opus 5 | $0.00060 | $0.03818 |
| Sonnet 5 | $0.00024 | $0.01527 |
| Haiku 4.5 | $0.00012 | $0.00764 |
Grade B, and why
project-discovery scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
- **IQL framing is optional.** Mention it only if the user asks "why this structure?" -- do not lecture them on methodology when they just want a working `business-data-map.md`. How it starts
The opening of the file, as written. The whole thing — 412 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Discovery — Onboarding Orchestrator
Turn an unknown codebase into a testable project. Four phases, always in order, gated on completion of the previous one. The output is a set of context files the rest of the skills (shift-left-testing, sprint-testing, test-automation, test-documentation, regression-testing) rely on.
The discovery is conversational: you read the code, ask when ambiguous, confirm before writing files. Never fabricate -- if you cannot verify a claim from the source, mark it as a "Discovery Gap" and move on.
Grounding methodology: IQL (Integrated Quality Lifecycle) — QA is continuous from requirement to release, not a gate at the end. The full rationale and step breakdown live in docs/methodology/IQL-methodology.md (shared across all QA skills). This skill does not depend on reading it — only point the user there if they ask why the discovery is structured this way.
Inputs
Canonical reading order when starting cold on a discovery run. Read in order; stop earlier when the scope is small enough that later inputs add no signal.
- Target project repo — path resolved at session start (see "Before starting: target repo location" below). Read code and any in-repo PRD. This is the primary source of truth — discovery is reverse-engineering, never aspirational design.
- Target repo's
README.mdand existing onboarding docs — fastest path to project intent, stack signals, and run commands before deep code reads. .context/directory (if partial state exists from a prior discovery run) — informs Phase 0 resume decisions and prevents redundant work. Diff against current code before overwriting..agents/project.yamland.env.example— variable resolution patterns ({{PROJECT_KEY}}, env URLs, MCP names) that every downstream context file references.kata-manifest.json— registry of existing KATA Components + ATCs. Anchors what test surface the boilerplate already expects so discovery records gaps coherently..agents/skills/agentic-qa-core/references/skill-composition-strategy.md— workflow context for downstream handoffs (project-context,adapt-framework,sprint-testing,test-documentation).- Business / domain docs supplied by the user (Confluence, Notion exports, internal wikis) — secondary source for business model and glossary when in-repo signal is thin.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 412 lines · 121 tokens per session scan B 82eab1042334
project-discovery is a skill published in the GitHub repository upex-galaxy/agentic-qa-boilerplate (21 stars, last pushed 4d ago), licensed MIT. It adds 121 tokens to every session and 7,636 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fw-ai-actions-app
Expert-level skill for AI Actions and integrations on Freshworks Platform 3.0. Use when (1) Creating actions.json and SMI functions (flat request, nested response), (2) Request templates and third-party API integration, (3) Pre-build validation (pricing, paywalls, account prerequisites), (4) Failure-case validation…
fw-review
Full Freshworks marketplace app review — iparams, frontend, serverless, FDK, security, and structured text report output — in one skill.
bootstrap-design
A guided process for choosing a user interface’s visual direction and recording the decisions in DESIGN.md.
discover-product
Run a multi-round discovery (persona / pain / JTBD / scenario / MVP / assumptions) and write DISCOVERY.md.
review-doc
A document-review process for finding missing requirements, contradictions, vague statements, hidden complexity, and overlooked edge cases.
research-pack
A research skill that uses official documents, primary sources, and academic papers to create a source-linked research note with confidence labels. It separates verified facts from conclusions drawn from those facts.