Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xiqin/loom/loom-qanpx skills add xiqin/loom --skill loom-qagit clone --depth 1 https://github.com/xiqin/loomWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xiqin/loom/loom-qa)<a href="https://agentmods.dev/skills/xiqin/loom/loom-qa"><img src="https://agentmods.dev/badge/skills/xiqin/loom/loom-qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.00876 |
| Opus 5 | $0.00035 | $0.00438 |
| Sonnet 5 | $0.00014 | $0.00175 |
| Haiku 4.5 | $0.00007 | $0.00088 |
Grade A, and why
loom-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
QA 验收流水线
定位
这是测试人员使用的流水线，与开发流水线完全独立。运行于功能开发完成后，目标是：
- 验证新功能符合 spec 描述
- 确认改动未破坏现有功能（回归）
- 验证模块间集成正确
- 维护持久化测试用例库（
.loom/qa-suite/），功能变更时同步更新用例
流水线阶段
QA 流水线（pipeline_type: qa）有 6 个阶段，每个阶段对应本 skill 的不同职责：
| 阶段 | 职责 | 使用子 prompt |
|---|---|---|
qa-analysis |
分析变更范围，确定测试矩阵 | qa-analyst-prompt.md |
qa-design |
生成/更新用例，旧用例转 deprecated | qa-designer-prompt.md |
qa-approved |
human-approval gate（自动） | — |
qa-execution |
跑自动化测试，生成手动 checklist | qa-executor-prompt.md |
qa-signoff |
human-approval gate，测试人员签字 | — |
qa-report |
汇总 → qa-report.md | qa-reporter-prompt.md |
执行规则
- 进入每个阶段前，读取对应子 prompt 文件（路径见下方）
- qa 战役目录：
qa/<date+target>/（不复用specs/） - 用例库：
.loom/qa-suite/，进版本控制，随功能迭代更新 - verdict 三态：
PASS（全绿）/PARTIAL（自动绿但手动有遗留）/FAIL（有测试失败） - CI 门禁：
loom run --spec-dir qa/<target> --verdict，exit 0=PASS，1=FAIL，2=PARTIAL - 每个非 gate 阶段完成后写入
qa/<date+target>/handoffs/<stage>.json，摘要说明阶段结论、关键产物、未决风险和下一阶段注意事项；不要把完整测试日志写进 handoff。
触发方式
# 初始化 qa 战役
loom run --type qa --spec-dir qa/$(date +%Y-%m-%d)+<target>
# 推进各阶段
loom run --spec-dir qa/<target> --advance --compression-confirmed
# 人工审批节点
loom run --spec-dir qa/<target> --approve
# CI 门禁查询
loom run --spec-dir qa/<target> --verdict
子 prompt 路径
references/qa-analyst-prompt.mdreferences/qa-designer-prompt.mdreferences/qa-executor-prompt.mdreferences/qa-reporter-prompt.md
完成条件
QA 阶段产物和对应 handoffs/<stage>.json 均完成后，先压缩旧阶段原始测试过程和长日志，再带压缩确认推进状态机；qa-report 作为终止阶段也必须写入 qa-report.md 与 handoffs/qa-report.json。
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 71 lines · 70 tokens per session scan A 8b6cb6f24e85
loom-qa is a skill published in the GitHub repository xiqin/loom (5 stars, last pushed 1mo ago), licensed MIT. It adds 70 tokens to every session and 876 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
research-engineer
An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.
tika-eval-compare
Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".
neuron-evaluation-engineer
Create and run AI evaluations with datasets, assertions, and output drivers in Neuron AI. Use this skill whenever the user mentions evaluation, testing AI systems, creating evaluators, dataset-driven testing, assertion-based validation, or wants to measure AI system performance. Also trigger for tasks involving…
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.
atmos-validation
Validate Atmos projects, components, arbitrary JSON Schema inputs, EditorConfig, and GitHub Actions; use affected-file selection and native CI annotations.
skill-benchmark
Benchmark AI skill effectiveness by measuring implementation quality against legacy constraints.