Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/vmobifystudio/app-dev-teamnpx agentmods add skills/vmobifystudio/app-dev-team/mutation-testingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vmobifystudio/app-dev-team/mutation-testing)<a href="https://agentmods.dev/skills/vmobifystudio/app-dev-team/mutation-testing"><img src="https://agentmods.dev/badge/skills/vmobifystudio/app-dev-team/mutation-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vmobifystudio/app-dev-team/mutation-testing"><img src="https://agentmods.dev/badge/skills/vmobifystudio/app-dev-team/mutation-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01079 |
| Opus 5.5 | $0.00033 | $0.00432 |
| Sonnet 5.5 | $0.00017 | $0.00216 |
| Haiku 4.5 | $0.00008 | $0.00108 |
Grade A, and why
mutation-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mutation testing
defect-hunting §3 says a new rule is not done until you have watched it fail, in three steps. That
instruction was followed by hand, when someone remembered. On 2026-07-29 the suite read
385 passed, 0 failed while containing a grep -E with a PCRE lookahead (a syntax error, stderr
to /dev/null, || ok every time), two doctor assertions that a demoted gate could not turn red,
and a hook that stood down in exactly the incident it was written for.
A green suite is evidence only to the extent its assertions can go red. scripts/mutate.sh is
that, executable.
Running it
sh scripts/mutate.sh # all 16 catalogued mutations (~1 min each — the whole suite runs)
sh scripts/mutate.sh --list # the catalogue, plus what it cannot test and why
sh scripts/mutate.sh --only M04 # one mutation, while you iterate on an assertion
sh scripts/mutate.sh --sample 4 # what CI runs on every PR
Exit 0 all caught · 1 something SURVIVED · 2 could not run (baseline not green, anchor drifted).
Three verdicts matter:
- CAUGHT (n assertions) — the gate bites.
- SURVIVED — the gate can be deleted and the suite stays green. That is a hole, and it is a finding at the same severity as the bug the gate was supposed to catch.
- CAUGHT, but NOT by the assertion written for it — some unrelated assertion noticed. Not a hole today; the named guard is decorative, and the next refactor that touches the unrelated one takes the coverage away silently. Fix the named assertion.
The rule
A new gate ships with a mutation proving its assertion bites. Adding a check to
board-doctor, ship-gate, verify-done, spawn-gate, a hook, or scripts/test.sh is not done
until scripts/mutate.sh --only <your-id> prints CAUGHT and names your assertion.
Adding one is four fields in the catalogue at the top of scripts/mutate.sh:
M17@@scripts/your-gate.sh@@<exact text to break>@@<replacement>@@<the test.sh label that must fail>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 81 lines · 83 tokens per session scan A 77b9915b9654
mutation-testing is a skill published in the GitHub repository vmobifystudio/app-dev-team (4 stars, last pushed 4d ago), licensed MIT. It adds 83 tokens to every session and 1,079 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
behavior-contract
Bug condition/postcondition formalization as testable Behavior Contracts. Defines invariants that must be preserved across fixes.
Test-first
Use before implementing a feature or bugfix — write the failing test before the code.
implement
For a build brief, implementing a spec or tracked item, or mid-build discoveries tempting scope expansion, build thin verified slices with test-first checks at named boundaries, proportional validation elsewhere, and respect for scope and commit instructions.
test-runner
Use this skill when orchestrating agentic end-to-end tests. Resolves target + profile, dispatches the right driver(s) (playwright for web today, peekaboo for macOS (issue #381)), invokes the ux-evaluator agent (opus, read-only) against driver artifacts, reconciles findings with the open issue tracker via…
tdd
This skill should be used when the user asks to "add a feature using TDD", "fix a bug with TDD", "do TDD", "red-green-refactor", "write a failing test first", "use test-driven development", "start TDD", "test first approach", "TDD loop", "TDD cycle", or mentions TDD workflow, baby steps, guessing game, or…
wave-execution-framework-v2
Use when executing multi-wave engineering work needing strict TDD, bug-capture/fix split, quality gates, and orchestrated teams with per-agent Opus-advisor / Sonnet-executor model routing.