Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/yike-gunshi/forge-skillsnpx agentmods add skills/yike-gunshi/forge-skills/forge-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yike-gunshi/forge-skills/forge-qa)<a href="https://agentmods.dev/skills/yike-gunshi/forge-skills/forge-qa"><img src="https://agentmods.dev/badge/skills/yike-gunshi/forge-skills/forge-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yike-gunshi/forge-skills/forge-qa"><img src="https://agentmods.dev/badge/skills/yike-gunshi/forge-skills/forge-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00148 | $0.03830 |
| Opus 5 | $0.00074 | $0.01915 |
| Sonnet 5 | $0.00030 | $0.00766 |
| Haiku 4.5 | $0.00015 | $0.00383 |
Grade A, and why
forge-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Mode B 入口校验**：`review_doc` 不存在 → 直接终止并报错；`bug_id` 缺失时取报告文件名。有 `worktree` 但没传 `app_url` 时，若验收项涉及浏览器/curl/截图，要求调用方先运行项目的 `dev:status` / `dev-stack status`，把 Frontend URL 作为 `app_url` 传入后再调用。 How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
文档落地路径：遵循 forge-doc-policy 规范。完整白名单 + frontmatter schema 见
~/.claude/skills/forge-doc-policy/doc-paths.md。 当前文档加载顺序：完整 QA 先读项目CLAUDE.md、docs/README.md、docs/INDEX.md、docs/QA.md当前验收手册和相关.features/{feature-id}/feature-spec.md；单 bug 回归读取活跃 BF 报告。 详细规则见~/.claude/skills/_shared/current-doc-loading.md。
/forge-qa：QA 验收与测试报告
纯验收模式：测试 + 报告，不修代码。 发现的问题生成结构化 bug 记录；单 bug 回归时回填 Bug 修复验收报告。
调用模式
forge-qa 支持两种调用模式，入口判断在前置脚本阶段完成（见"前置脚本"节）。
| 模式 | 触发条件 | 输入 | 输出 | 下游 |
|---|---|---|---|---|
| Mode A：完整 QA | 用户直接触发，或 forge-dev 调度 | PRD / DESIGN / git diff | QA.md 报告 + 结构化 bug 候选 + User Gate | forge-ship / forge-bugfix / forge-eng |
| Mode B：单 bug 修复验收报告 | forge-bugfix 的 P6 调用；入口带参数 review_doc=docs/bugfix/reviews/BF-XX.md |
单 bug Bug 修复验收报告 | 报告内 QA 证据区、环境身份校验、逐步截图回填 | forge-bugfix 的 P6.5 / 批次最终验收 / P5（回修） |
模式判断优先级（AI 从 args 或触发消息中判断，从高到低）：
- 显式参数 — Skill 调用时 args 含
mode=B和review_doc=<路径>→ 直接 Mode B - 调用来源 — 触发消息里出现 "forge-bugfix"、"review-checklist"、
BF-\d+-\d+.md文件路径 → Mode B（从消息里提取 review_doc 路径，其余必需参数从报告或上下文推断） - 默认 — Mode A
Mode B 入口校验：review_doc 不存在 → 直接终止并报错；bug_id 缺失时取报告文件名。有 worktree 但没传 app_url 时，若验收项涉及浏览器/curl/截图，要求调用方先运行项目的 dev:status / dev-stack status，把 Frontend URL 作为 app_url 传入后再调用。
Mode B 详见"## Mode B：单 bug 修复验收报告模式"节（本文档末尾）。
Mode A 详见"## 三层架构"往下的完整流程。
Mode B 的 args 契约（forge-bugfix 必须传，forge-qa 必须接收）：
| 参数 | 必填 | 含义 |
|---|---|---|
mode=B |
✅ | 强制信号，优先级最高 |
review_doc=<路径> |
✅ | Bug 修复验收报告（存在性校验失败直接 exit） |
bug_id=BF-{MMDD}-{N} |
✅ | 用于命名截图 / 日志 |
worktree=<路径> |
✅ | 在该 worktree 内运行测试 |
commit=<hash> |
✅ | 用于定位修复范围 |
app_url=<URL> |
条件 | 仅当 bug 类型涉及应用运行时；必须来自调用方的 dev:status / dev-stack status 输出 |
三层架构
┌─────────────────────────────────────────────────┐
│ Layer 1: 测试规格生成（文档 → test-spec.json） │
│ 输入: PRD / DESIGN.md / git diff / 会话上下文 │
├─────────────────────────────────────────────────┤
│ Layer 2: 10 维度 Playwright 断言引擎 │
│ 控制台|数据驱动|网络|视觉|交互|响应式|可访问|SSE|URL|懒加载│
├─────────────────────────────────────────────────┤
│ Layer 3: 智能分析（失败归因 + 根因定位） │
│ console → 源码 → git diff 交叉引用 │
└─────────────────────────────────────────────────┘
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 245 lines · 148 tokens per session scan A 5d67f8ae2494
forge-qa is a skill published in the GitHub repository yike-gunshi/forge-skills (13 stars, last pushed 1mo ago), licensed MIT. It adds 148 tokens to every session and 3,830 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
writing-tests
Write unit tests, component tests, and integration tests for AiderDesk using Vitest and React Testing Library. Use when creating new tests, adding test coverage, configuring mocks, setting up test files, or debugging failing tests.
architecture-patterns
Architecture validation and patterns for clean architecture, backend structure enforcement, project structure validation, test standards, and context-aware sizing. Use when designing system boundaries, enforcing layered architecture, validating project structure, defining test standards, or choosing the right…
vastai
Vast.ai CLI to manage GPU instances, volumes, serverless endpoints, and billing.
testing-e2e
End-to-end testing patterns with Playwright — page objects, AI agent testing, visual regression, accessibility testing with axe-core, and CI integration. Use when writing E2E tests, setting up Playwright, implementing visual regression, or testing accessibility.
testing-llm
LLM and AI testing patterns — mock responses, evaluation with DeepEval/RAGAS, structured output validation, and agentic test patterns (generator, healer, planner). Use when testing AI features, validating LLM outputs, or building evaluation pipelines.
design-ship
One-shot pipeline turning a claude.ai/design link into a pull request: scaffold via /ork:design-import, stories and specs via /ork:cover, browser verification via /ork:expect, then open the PR. Use when a design link should come back as a PR with no intermediate steps; if all you need is the components written to…