Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/victoraguilarsantamariadev/qa-explore/qa-plannpx skills add victoraguilarsantamariadev/qa-explore --skill qa-plangit clone --depth 1 https://github.com/victoraguilarsantamariadev/qa-exploreWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00120 | $0.01183 |
| Opus 5 | $0.00060 | $0.00592 |
| Sonnet 5 | $0.00024 | $0.00237 |
| Haiku 4.5 | $0.00012 | $0.00118 |
Grade A, and why
qa-plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
qa-plan
Top QA teams don't test everything equally — they test by risk. qa-plan is the upfront half of the process: it decides what to test and in what order before a single expensive explore agent runs, so effort lands on the surface where a bug would hurt most and is most likely.
recon the app → per area: IMPACT (blast radius if it breaks) × LIKELIHOOD (how fragile / how changed)
→ risk score (deterministic) → rank P0 / P1 / P2
→ acceptance ("done") per area
charter OUT → test-plan.md (the plan a lead reviews) [GATE: you approve/re-rank]
→ seeds qa-explore `areas` in PRIORITY ORDER (riskiest first)
🔒 The priority is deterministic
An agent judges impact and likelihood (1–5 each, with a written rationale) — but the risk score and P0/P1/P2 band are computed by rules (impact × likelihood), so the ranking is consistent and defensible, not a vibe. Same judgements → same plan. (Same principle as qa-gate: the model assesses, the rules rank.)
The default risk rubric (configurable in plan)
- impact 1–5: blast radius if this area is broken — money/data/security/legal at the top, cosmetic at the bottom.
- likelihood 1–5: how likely it is broken — new/changed code, complex flows, past-bug hotspots, many integrations rank high.
- risk = impact × likelihood (1–25). Bands (defaults): P0 ≥ 15, P1 8–14, P2 < 8.
- Each area gets an acceptance line ("done" = the concrete happy path + the key negative/edge case that must hold) so the explore pass and the gate share one definition of success.
Engine (invoke via the Workflow tool; do not inline)
${CLAUDE_PLUGIN_ROOT}/skills/qa-plan/engine/qa-plan.workflow.js
(If $CLAUDE_PLUGIN_ROOT is unset, the skill is at ~/.claude/skills/qa-plan — resolve the engine path relative to this SKILL.md.)
Prerequisites
- The same
qa.config.jsonqa-explore uses (baseUrl,login, etc.). Optionalplanblock:bands(P0/P1 thresholds),outFile(defaulttest-plan.md),changed(a list/paths of what changed this release, to raise likelihood on touched areas),releaselabel.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 51 lines · 120 tokens per session scan A 058646044f33
qa-plan is a skill published in the GitHub repository victoraguilarsantamariadev/qa-explore (2 stars, last pushed 29d ago), licensed MIT. It adds 120 tokens to every session and 1,183 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-cli
Automate browser interactions, test web pages and work with Playwright tests.
playwright-component-testing
Set up component testing with Playwright using a story gallery — scaffold stories and a gallery dev page driven by the built-in mount fixture, no dedicated component-testing runtime. Use when asked to test React or Vue components in isolation with Playwright, or to migrate off @playwright/experimental-ct-react / -vue.
playwright-trace
Inspect Playwright trace files from the command line — list actions, view requests, console, errors, snapshots and screenshots.
playwright-triage
Triage a Playwright bug report by reproducing it from the information in the issue. Use when asked to triage, reproduce, or verify a GitHub issue (a new bug report, or an existing report with a new comment).
playwright-dev
Explains how to develop Playwright - add APIs, MCP tools, CLI commands, and vendor dependencies.
Axe-core Accessibility Testing
Accessibility testing skill using axe-core and Playwright for automated WCAG 2.1 compliance auditing, custom rules, and accessibility reporting.