Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wasintoh/toh-framework --skill test-engineergit clone --depth 1 https://github.com/wasintoh/toh-frameworkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wasintoh/toh-framework/test-engineer)<a href="https://agentmods.dev/skills/wasintoh/toh-framework/test-engineer"><img src="https://agentmods.dev/badge/skills/wasintoh/toh-framework/test-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wasintoh/toh-framework/test-engineer"><img src="https://agentmods.dev/badge/skills/wasintoh/toh-framework/test-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 3 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- medium MCP Rug Pull · line 39 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 367 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.03093 |
| Opus 5.5 | $0.00030 | $0.01237 |
| Sonnet 5.5 | $0.00015 | $0.00619 |
| Haiku 4.5 | $0.00007 | $0.00309 |
Grade A, and why
test-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 474 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Engineer Skill
Overview
Skill for automated testing with Playwright, including auto-fix loop capability.
Core Philosophy
"Test until it passes, not just test and report"
- Auto-Generate Tests - Generate test cases from UI automatically
- Auto-Fix Loop - If fails, fix and re-test until passing
- Human-Readable Reports - Easy to understand reports
- Language-Adaptive - Error messages adapt to project language setting
Tech Stack
| Tool | Purpose |
|---|---|
| Playwright | E2E Testing |
| @playwright/test | Test Runner |
| playwright-report | HTML Reports |
Setup
1. Install Playwright
npm install -D @playwright/test
npx playwright install
2. Config File
Create playwright.config.ts:
import { defineConfig, devices } from '@playwright/test'
export default defineConfig({
testDir: './tests',
fullyParallel: true,
forbidOnly: !!process.env.CI,
retries: process.env.CI ? 2 : 0,
workers: process.env.CI ? 1 : undefined,
reporter: [
['html'],
['list']
],
use: {
baseURL: 'http://localhost:3000',
trace: 'on-first-retry',
screenshot: 'only-on-failure',
video: 'retain-on-failure',
},
projects: [
{
name: 'chromium',
use: { ...devices['Desktop Chrome'] },
},
{
name: 'Mobile Chrome',
use: { ...devices['Pixel 5'] },
},
],
webServer: {
command: 'npm run dev',
url: 'http://localhost:3000',
reuseExistingServer: !process.env.CI,
timeout: 120 * 1000,
},
})
3. Test Directory Structure
tests/
├── auth/
│ ├── login.spec.ts
│ └── register.spec.ts
├── dashboard/
│ └── dashboard.spec.ts
├── products/
│ ├── list.spec.ts
│ └── detail.spec.ts
├── checkout/
│ └── flow.spec.ts
└── fixtures/
└── test-data.ts
Test Generation Patterns
Pattern 1: Page Render Test
Every page must have a test to verify correct rendering:
import { test, expect } from '@playwright/test'
test.describe('Products Page', () => {
test('should render correctly', async ({ page }) => {
await page.goto('/products')
// Check title
await expect(page).toHaveTitle(/Products/)
// Check main heading
await expect(
page.getByRole('heading', { name: 'All Products' })
).toBeVisible()
// Check key elements exist
await expect(page.getByTestId('product-grid')).toBeVisible()
await expect(page.getByRole('searchbox')).toBeVisible()
})
})
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 474 lines · 75 tokens per session scan A ad763e283b79
test-engineer is a skill published in the GitHub repository wasintoh/toh-framework (98 stars, last pushed 1mo ago), licensed MIT. It adds 75 tokens to every session and 3,093 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
test-pr-e2e
Test a PR or MR like a human QA engineer using Playwright MCP. Analyzes the diff (or diffs, for a multi-service/microservice feature spanning several PRs) to generate a scenario list (Phase 1), then executes each scenario live in a browser with inline logging and screenshots (Phase 2). Use when asked to "test this PR…
composio-webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
browser-testing-with-devtools
Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be…
awt-e2e-testing
AI-powered E2E web testing — eyes and hands for AI coding tools. Declarative YAML scenarios, Playwright execution, visual matching (OpenCV + OCR), platform auto-detection (Flutter/React/Vue), learning DB. Install: npx skills add ksgisang/awt-skill --skill awt -g.
selectors
Selector strategy, exploration-first workflow, locator priority order (getByRole then getByLabel then getByPlaceholder then getByText then getByTestId), and feedback/validation-message selector rules for Playwright page objects. Use when creating page objects, writing or updating locators, generating UI tests, or…
test-app
Verify a running Mendix app in a browser: mxcli playwright check for a one-call text verdict per page (renders? error banner? console errors? rows?), playwright-cli scripts for interaction, OQL for data. Use when asked to check a page, see whether it renders, verify in the browser, test the app end to end, or confirm…