Borrowing it
Nothing to install: this file belongs to XMethues/clawchat-plugin-connect. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/XMethues/clawchat-plugin-connect/main/.agents/skills/clawchat-connect-qa/SKILL.mdgit clone --depth 1 https://github.com/XMethues/clawchat-plugin-connectWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xmethues/clawchat-plugin-connect/clawchat-connect-qa)<a href="https://agentmods.dev/skills/xmethues/clawchat-plugin-connect/clawchat-connect-qa"><img src="https://agentmods.dev/badge/skills/xmethues/clawchat-plugin-connect/clawchat-connect-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xmethues/clawchat-plugin-connect/clawchat-connect-qa"><img src="https://agentmods.dev/badge/skills/xmethues/clawchat-plugin-connect/clawchat-connect-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01157 |
| Opus 5 | $0.00051 | $0.00579 |
| Sonnet 5 | $0.00020 | $0.00231 |
| Haiku 4.5 | $0.00010 | $0.00116 |
Grade A, and why
clawchat-connect-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ClawChat Connect QA
Test what the user can actually see and do. Treat repository tests and service logs as supporting evidence, never as a substitute for the real ClawChat or Connect Client surface.
Surface policy
- Test ClawChat behavior through the Android debug app by SSHing to
clawlingdevand targeting ADB deviceemulator-5558. - Android is the default and exclusive ClawChat behavior surface. Do not fall back to local Desktop CUA when Android is unavailable; classify the affected row as
environment-blocked. - Use the installed debug app as-is. Do not inspect its version, reinstall it, clear its data, or otherwise manage the app unless the task explicitly concerns installation or upgrade behavior.
- Dedicated QA Agent conversations and conversations explicitly named as QA targets are standing-authorized for uniquely labeled test messages and Connect control commands. Do not broaden that authorization to ordinary contacts, groups, account settings, Moments, or app registration.
- Choose Session isolation and cleanup from the behavior under test. Use a fresh Session when prior Runtime state could affect the result; do not create one mechanically for tests where Session state is irrelevant.
- Desktop remains available only when the target is genuinely surface-specific, such as Liveware wide/narrow responsive layout or desktop WebView presentation. Do not duplicate ordinary ClawChat behavior checks on Desktop.
- Prefer structured Android UI state such as UIAutomator XML for interaction and assertions. Use screenshots when layout or rendering is itself the behavior under test.
Prepare the run
- Read
references/capability-matrix.mdand mark every applicable row pending. - Record the installed Connect version,
doctor, service status, configured Agent Bindings, and the test conversations authorized by the user. - Generate a unique run label such as
connect-qa-YYYYMMDD-HHMMand use it in Session names and reversible test content. - Choose the Session and cleanup strategy required by the behavior under test; when a fresh Session is required, use
/new <run-label>. - Inspect the current Android ClawChat UI on
clawlingdev/emulator-5558before acting. Use Desktop only for the surface-specific exceptions above and Browser only for the standalone loopback Connect Client.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 58 lines · 102 tokens per session scan A f2c714a6d9bc
clawchat-connect-qa is a skill published in the GitHub repository XMethues/clawchat-plugin-connect (2 stars, last pushed 11d ago), licensed MIT. It adds 102 tokens to every session and 1,157 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
daytona-windows-cert
Run the verified Windows repro for iPolloWork enterprise TLS behavior: install a fake corporate CA into the Windows machine store, serve healthy and broken HTTPS control planes, install a Windows build, and prove the desktop app and spawned runtimes use the operating system trust path.
daytona-recording-artifacts
Use this skill to collect proof that a Daytona UI flow works. Use fraimz before declaring the flow passed. If the user asks to do e2e tests for a feature, frame proof is required unless they explicitly ask for non-UI or mock-only validation.
fraimz
create a fraimz, make fraimz, prove it works, frame proof, PR proof, validate experience, e2e evidence, fraimz.html. The full fraimz loop — frame the claim, drive the real app via CDP, validate/repair, output fraimz.html. Use whenever a task ends with "please create a fraimz" or any change needs end-to-end proof.
run-evals
Launch a real iPolloWork app and run coded eval flows against it. This skill owns launch + run; the prove/repair/verdict loop and evidence standard live in the fraimz skill — load that too for anything that ends in a verdict.
daytona-electron-den
Electron and Den, desktop plus cloud, two-sandbox e2e, cloud auth, marketplace, org policy, worker proxy, provider sync, desktop handoff. Validate Electron against a Daytona Den server with unified proof.
appium-python-expert
Specialist skill for mobile E2E testing with Appium 2.x + Python (pytest) for Android and iOS. Use this skill whenever the user asks about: setting up Appium with Python, writing mobile test cases, configuring Android/iOS drivers (UIAutomator2, XCUITest), implementing Page Object Model for mobile, running tests with…