Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vmobifystudio/app-dev-team/mutation-testingnpx skills add vmobifystudio/app-dev-team --skill mutation-testinggit clone --depth 1 https://github.com/vmobifystudio/app-dev-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vmobifystudio/app-dev-team/mutation-testing)<a href="https://agentmods.dev/skills/vmobifystudio/app-dev-team/mutation-testing"><img src="https://agentmods.dev/badge/skills/vmobifystudio/app-dev-team/mutation-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.01079 |
| Opus 5 | $0.00042 | $0.00540 |
| Sonnet 5 | $0.00017 | $0.00216 |
| Haiku 4.5 | $0.00008 | $0.00108 |
Grade A, and why
mutation-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mutation testing
defect-hunting §3 says a new rule is not done until you have watched it fail, in three steps. That
instruction was followed by hand, when someone remembered. On 2026-07-29 the suite read
385 passed, 0 failed while containing a grep -E with a PCRE lookahead (a syntax error, stderr
to /dev/null, || ok every time), two doctor assertions that a demoted gate could not turn red,
and a hook that stood down in exactly the incident it was written for.
A green suite is evidence only to the extent its assertions can go red. scripts/mutate.sh is
that, executable.
Running it
sh scripts/mutate.sh # all 16 catalogued mutations (~1 min each — the whole suite runs)
sh scripts/mutate.sh --list # the catalogue, plus what it cannot test and why
sh scripts/mutate.sh --only M04 # one mutation, while you iterate on an assertion
sh scripts/mutate.sh --sample 4 # what CI runs on every PR
Exit 0 all caught · 1 something SURVIVED · 2 could not run (baseline not green, anchor drifted).
Three verdicts matter:
- CAUGHT (n assertions) — the gate bites.
- SURVIVED — the gate can be deleted and the suite stays green. That is a hole, and it is a finding at the same severity as the bug the gate was supposed to catch.
- CAUGHT, but NOT by the assertion written for it — some unrelated assertion noticed. Not a hole today; the named guard is decorative, and the next refactor that touches the unrelated one takes the coverage away silently. Fix the named assertion.
The rule
A new gate ships with a mutation proving its assertion bites. Adding a check to
board-doctor, ship-gate, verify-done, spawn-gate, a hook, or scripts/test.sh is not done
until scripts/mutate.sh --only <your-id> prints CAUGHT and names your assertion.
Adding one is four fields in the catalogue at the top of scripts/mutate.sh:
M17@@scripts/your-gate.sh@@<exact text to break>@@<replacement>@@<the test.sh label that must fail>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 81 lines · 83 tokens per session scan A 77b9915b9654
mutation-testing is a skill published in the GitHub repository vmobifystudio/app-dev-team (4 stars, last pushed 25d ago), licensed MIT. It adds 83 tokens to every session and 1,079 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
Test-first
Use before implementing a feature or bugfix — write the failing test before the code.
execute-task
Implement one task (or a cohesion bundle) from a signed-off spec (Ready or Active): recompute the execution freshness gate, write the verifying test first, implement to green, run the project's full CI with adaptive retry, converge via the configured reviewsequence (default /polish --nested), then open a draft PR…
builder
Detect a project's stack and recommend or apply the universal mechanical quality guards from planwright's core catalog (formatter, linters, type-checker, test runner, secret scan, commit hooks, CI gate), plus the growable breadth dimensions. Escalates stake-bearing decisions (auth, data modeling, security posture…
spec-walkthrough
Render a spec bundle (or a chosen slice) into a plain-language, didactic comprehension artifact a human reads and judges for themselves: an unaided cold read before kickoff, re-orientation mid-execution, or onboarding to a finished or abandoned spec. Standalone and strictly read-only: it renders any status, never…
drain
Run the on-demand drain pass over every spec bundle's Gate deferral entries: evaluate structured GATE(when:) conditions, surface date and free-text gates, report malformed ones, inventory each live bundle's [manual] test-spec entries, and surface the observations log's unmined state. Read-only; nothing is…
implementing-tasks
Use when executing a batch of TDD-sized tasks inside a running-an-iteration call — dispatches an implementer subagent per task following red-green-refactor discipline and returns per-task completion status.