Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add upex-galaxy/agentic-qa-boilerplate --skill sprint-testinggit clone --depth 1 https://github.com/upex-galaxy/agentic-qa-boilerplateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing)<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 68 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- medium Output Handling · line 8 Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.Fix: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output.
- medium Prompt Injection · line 147 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 437 Subtle instructions detected that may alter agent decision-making or introduce hidden biases.Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00213 | $0.19767 |
| Opus 5 | $0.00106 | $0.09884 |
| Sonnet 5 | $0.00043 | $0.03953 |
| Haiku 4.5 | $0.00021 | $0.01977 |
Grade B, and why
sprint-testing scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
- **Nothing local is a deliverable.** `.session/` is gitignored and exists only on this machine. The sprint's shareable record is the STP in Jira (description ← `plan.md`, comments ← `progress.md`) and the per-Story ATP Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- API testing = three-tool maneuver: OpenAPI MCP for schema (READ-ONLY) → `bun run api:login` for the token (→ `.auth/tokens.env`) → **curl** for authenticated requests. NEVER execute via the OpenAPI MCP. Canon: `agentic How it starts
The opening of the file, as written. The whole thing — 556 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forbidden invocations
NEVER invoke /sdd-* skills from this workflow. SDD is an optional
user-installed ceremony; this skill ships self-contained and does not chain
SDD under any condition. If you need to refactor KATA, fixtures, cli/,
scripts/, or api/schemas/ pipeline, exit this skill first and invoke
/framework-development — which itself runs Plan → Code → Verify → Archive
natively (no SDD required).
This boundary is mechanical, not advisory: scripts/lint-skills.ts rejects
any /sdd- mention outside this section. See:
.agents/skills/agentic-qa-core/references/skill-composition-strategy.md §4
(governs users who manually install SDD).
Sprint Testing — Plan, Execute, Report per Ticket
Drive the manual / exploratory QA loop for a single ticket during a sprint. Three stages, always in this order: Stage 1 Planning -> Stage 2 Execution -> Stage 3 Reporting. Hand off afterwards to the skills that own Stage 4, 5 and 6.
The same three-stage pipeline runs in every mode. Only the entry point and the bookkeeping differ: one issue at a time (single-issue), or the whole sprint's QA backlog driven by a sprint-level session pair (sprint-wide).
"Issue", not "story", throughout: Story, Bug, Defect, Improvement, Tech Story and Tech Debt are all coverable, and the sprint queue holds whichever of them the project declares.
Dependencies
Requires agentic-qa-core. Loads on demand:
agentic-qa-core/references/test-design-doctrine.md— MANDATORY before designing any ATP / TC coverage from acceptance criteria. Governs the 5 principles, the floor-not-ceiling coverage model, the 1:N explode-default rule, and the formal-technique triggers.agentic-qa-core/references/defect-management-doctrine.md— MANDATORY before taking a Story into testing and before filing any Bug / Defect / Improvement. Governs issue-type classification (Bug vs Defect vs Improvement by feature lifecycle), the QA-Assignee self-assign + never-overwrite rule, mandatory Components, the three-axis model (parent = QA process epic · link = source Story · components = product module), and Severity→Priority auto-derive.agentic-qa-core/references/briefing-template.md,agentic-qa-core/references/dispatch-patterns.md,agentic-qa-core/references/orchestration-doctrine.md,agentic-qa-core/references/session-management.md,agentic-qa-core/references/preflight-gate.md,agentic-qa-core/references/adr-doctrine.md— cited inline by the sections that use them.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +59 lines · -5 tokens per session scan A → B 4d572435fd86
- 9d ago First seen · 497 lines · 218 tokens per session scan A aeb1098dd707
sprint-testing is a skill published in the GitHub repository upex-galaxy/agentic-qa-boilerplate (21 stars, last pushed 3d ago), licensed MIT. It adds 213 tokens to every session and 19,767 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 2 findings (subtle steering, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
qa-project-bootstrap
Onboard a new QA engineer to an existing codebase, or audit an existing test architecture. Produces a 30-day ramp plan: codebase orientation, framework walkthrough, test architecture audit, mentorship pairing, and first-test guidance. Use when: "QA onboarding," "new tester," "ramp up," "test architecture audit,"…
he-eval-report
Generate closure-grade HE eval and drift proof for one execution slice. Use when Linear, milestone, or source-prompt closure needs validation evidence.
discover-product
Run a multi-round discovery (persona / pain / JTBD / scenario / MVP / assumptions) and write DISCOVERY.md.
finding-reconciliation
Merge the independent A/B/C findings tables into one adjudicated ledger in 07-verification/documentation-verification-report.md — normalizing to the finding schema, deduplicating by location and claim, recording per-finding corroboration without downgrading single-pass findings, promoting cross-pass disagreement to…
scoring-and-release-gate
Score a documentation package against the ten-dimension weighted rubric in references/scorecard-rubric.md with a cited justification per dimension, then evaluate the nineteen conditions in references/release-gate-conditions.md and emit a binary release-ready, conditionally-ready, or not-ready verdict with…
accept-milestone
Use ONLY when the user explicitly types $accept-milestone . Do not trigger implicitly from generic phrasing.