Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add upex-galaxy/agentic-qa-boilerplate --skill sprint-testinggit clone --depth 1 https://github.com/upex-galaxy/agentic-qa-boilerplateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing)<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing"><img src="https://agentmods.dev/badge/skills/upex-galaxy/agentic-qa-boilerplate/sprint-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Memory Poisoning · line 68 Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
- medium Output Handling · line 8 Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.Fix: Set explicit limits on output length, generation count, and rate. Use max_tokens and truncation to prevent unbounded output.
- medium Prompt Injection · line 147 Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.Fix: Remove the large whitespace padding (blank-line blocks or long space runs) and review any content hidden below or to the right of it. Keep skill files compact and reviewable so no instructions can be
- medium Prompt Injection · line 437 Subtle instructions detected that may alter agent decision-making or introduce hidden biases.Fix: Review content for implicit steering or bias. Ensure instructions are explicit and align with the skill's stated purpose.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00213 | $0.25372 |
| Opus 5.5 | $0.00085 | $0.10149 |
| Sonnet 5.5 | $0.00043 | $0.05074 |
| Haiku 4.5 | $0.00021 | $0.02537 |
Grade B, and why
sprint-testing scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
- **Nothing local is a deliverable.** `.session/` is gitignored and exists only on this machine. The sprint's shareable record is the STP in Jira (description ← `plan.md`, comments ← `progress.md`) and the per-Story ATP Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- API testing = three-tool maneuver: OpenAPI MCP for schema (READ-ONLY) → `bun run api:login` for the token (→ `.auth/tokens.env`) → **curl** for authenticated requests. NEVER execute via the OpenAPI MCP. Canon: `agentic How it starts
The opening of the file, as written. The whole thing — 656 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forbidden invocations
NEVER invoke /sdd-* skills from this workflow. SDD is an optional
user-installed ceremony; this skill ships self-contained and does not chain
SDD under any condition. If you need to refactor KATA, fixtures, cli/,
scripts/, or api/schemas/ pipeline, exit this skill first and invoke
/framework-development — which itself runs Plan → Code → Verify → Archive
natively (no SDD required).
This boundary is mechanical, not advisory: scripts/lint-skills.ts rejects
any /sdd- mention outside this section. See:
.agents/skills/agentic-qa-core/references/skill-composition-strategy.md §4
(governs users who manually install SDD).
Sprint Testing — Plan, Execute, Report per Ticket
Drive the manual / exploratory QA loop for a single ticket during a sprint. Three stages, always in this order: Stage 1 Planning -> Stage 2 Execution -> Stage 3 Reporting. Hand off afterwards to the skills that own Stage 4, 5 and 6.
The same three-stage pipeline runs in every mode. Only the entry point and the bookkeeping differ: one issue at a time (single-issue), or the whole sprint's QA backlog driven by a sprint-level session pair (sprint-wide).
"Issue", not "story", throughout: every coverable work type .agents/jira-required.yaml declares (work_types.*.coverable) is in scope, and the sprint queue holds whichever of them the project declares.
Dependencies
Requires agentic-qa-core. Loads on demand:
agentic-qa-core/references/test-design-doctrine.md— MANDATORY before designing any ATP / TC coverage from acceptance criteria. Governs the 5 principles, the floor-not-ceiling coverage model, the 1:N explode-default rule, and the formal-technique triggers.agentic-qa-core/references/defect-management-doctrine.md— MANDATORY before taking a Story into testing and before filing any Bug / Defect / Improvement. Governs issue-type classification (Bug vs Defect vs Improvement by feature lifecycle), the QA-Assignee self-assign + never-overwrite rule, mandatory Components, the three-axis model (parent = QA process epic · link = source Story · components = product module), and Severity→Priority auto-derive.agentic-qa-core/references/briefing-template.md,agentic-qa-core/references/dispatch-patterns.md,agentic-qa-core/references/orchestration-doctrine.md,agentic-qa-core/references/session-management.md,agentic-qa-core/references/preflight-gate.md,agentic-qa-core/references/adr-doctrine.md— cited inline by the sections that use them.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 3.2 KB
- references/acceptance-test-planning.md 40 KB
- references/exploration-patterns.md 21 KB
- references/feature-test-planning.md 22 KB
- references/fleet-conductor.md 28 KB
- references/reporting-templates.md 39 KB
- references/session-entry-points.md 44 KB
- references/sprint-orchestration.md 71 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed 4b600ff07e17
- 19d ago Changed · +2 lines 9cf68d438906
- 21d ago Changed · +4 lines fda34dd1031e
- 22d ago Changed a6acd28394d2
- 23d ago Changed · +1 lines 3f7f447bef00
- 28d ago Changed · +3 lines 23721e09ba27
- 29d ago Changed · +2 lines 6f10c17021ad
- 1mo ago Changed · +2 lines 1080a92f66ce
- 1mo ago Changed · +10 lines c71eabe6d79b
- 1mo ago First seen · 632 lines · 213 tokens per session scan B 56cfd1221185
sprint-testing is a skill published in the GitHub repository upex-galaxy/agentic-qa-boilerplate (26 stars, last pushed today), licensed MIT. It adds 213 tokens to every session and 25,372 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it B with 2 findings (subtle steering, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
qa-project-bootstrap
Onboard a new QA engineer to an existing codebase, or audit an existing test architecture. Produces a 30-day ramp plan: codebase orientation, framework walkthrough, test architecture audit, mentorship pairing, and first-test guidance. Use when: "QA onboarding," "new tester," "ramp up," "test architecture audit,"…
build-evaluate
Verify a completed build against the PRD's anchor case and success criteria. Runs the acceptance test and anchor-case check (serial across drivers sharing a write root), fans out 2-3 read-only cold-read agents (fresh-eyes, anti-scope-creep, drift-vs-mirror). On FAIL, auto-invokes five-whys for root-cause. On PASS with…
finding-reconciliation
Merge the independent A/B/C findings tables into one adjudicated ledger in 07-verification/documentation-verification-report.md — normalizing to the finding schema, deduplicating by location and claim, recording per-finding corroboration without downgrading single-pass findings, promoting cross-pass disagreement to…
scoring-and-release-gate
Score a documentation package against the ten-dimension weighted rubric in references/scorecard-rubric.md with a cited justification per dimension, then evaluate the nineteen conditions in references/release-gate-conditions.md and emit a binary release-ready, conditionally-ready, or not-ready verdict with…
he-eval-report
Generate closure-grade HE eval and drift proof for one execution slice. Use when Linear, milestone, or source-prompt closure needs validation evidence.
he-work
Executes bounded implementation work from approved specs, plans, issues, or small fixes by editing files, running validation, preserving unrelated work, and recording rollback and handoff evidence. Use when asked to implement, execute a plan, apply changes, or build a scoped feature.