Agent skill · Audited from source
Test Strategy
skill · echoVic/boss-skillMIT licenceAudited 15 Oct 2026 · source 0317d4cb4f54
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0317d4cb4f54 and found no filesystem, network or shell access and no hard-coded secrets. What it does: 测试策略和测试金字塔原则,定义单元测试、集成测试、E2E测试的分布和覆盖要求
Cite
Cite this page
ModelsAtlas. “Test Strategy (echoVic/boss-skill)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/echovic/test-strategy
Trust audit
Audit 0.4.1 · source read 15 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 0317d4cb4f54 · 15 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- PublisherechoVic GitHub userOwner of the repository this skill is read from
- Source folderechoVic/boss-skill/skill/skills/qa/test-strategyThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict0317d4cb4f54A new audit runs when the source changes
- Repository statusNot archivedLast push 4 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: 测试策略和测试金字塔原则,定义单元测试、集成测试、E2E测试的分布和覆盖要求
---
name: qa/test-strategy
description: 测试策略和测试金字塔原则,定义单元测试、集成测试、E2E测试的分布和覆盖要求
version: 1.0.0
agent: qa
type: methodology
user-invocable: false
agent-invocable: true
dependencies:
- shared/tech-stack-detection
triggers:
- 开始测试工作时
- 需要制定测试计划时
metadata:
internal: true
---
# 测试策略与测试金字塔
## 测试金字塔原则
```
/\
/ \
/ E2E \ ← ~10%:端到端用户流程【必须编写】
/--------\
/ 集成测试 \ ← ~20%:组件/服务/API 交互
/--------------\
/ 单元测试 \ ← ~70%:函数/组件/服务逻辑
/--------------------\
```
### E2E 测试是强制要求
**每个项目必须编写 E2E 测试**,最少覆盖:
- 创建流程
- 编辑流程
- 删除流程
- 列表展示
- 核心业务流程
### 前端 vs 后端测试分布
| 层级 | 前端测试 | 后端测试 |
|------|----------|----------|
| **单元测试** | 组件渲染、Hooks、工具函数 | Service 层、业务逻辑、工具类 |
| **集成测试** | 组件交互、状态管理、API 调用 | API 端点、数据库操作、服务间调用 |
| **E2E 测试** | UI 用户流程 | API 完整流程、跨服务调用 |
## QA Attack Protocol
- **重放核心用户路径**:证明核心用户路径真实可用
- **捕获真实 payload 与服务端响应**:验证请求 payload、服务端响应和 schema 一致性
- **攻击认证授权**:覆盖匿名、授权、非授权、过期、越权
- **攻击数据边界**:empty state、pagination、第二页、旧数据、illegal enum、long input、double submit
- **攻击业务一致性**:核对界面展示与服务端业务常量一致
- **验证产物类功能**:验证核心产物、记录或状态存在、可展示、可继续用于下游流程
- **标记未验证路径**:若核心用户路径只由 Mock 或桩数据证明,必须标记为未验证,不能作为发布证据
## 安全测试
| 测试类型 | 测试内容 | 示例 |
|----------|----------|------|
| **SQL 注入** | 参数化查询验证 | `' OR '1'='1` |
| **XSS** | 输出转义验证 | `<script>alert(1)</script>` |
| **CSRF** | Token 验证 | 跨站请求测试 |
| **认证** | Token 有效性 | 过期/伪造 Token |
| **授权** | 权限边界 | 越权访问测试 |
| **输入验证** | 边界值/格式 | 超长/特殊字符 |
## 性能测试
| 指标 | 前端目标 | 后端目标 |
|------|----------|----------|
| 首屏加载 | < 3s | - |
| API P50 | - | < 100ms |
| API P99 | - | < 500ms |
| 并发用户 | - | ≥ 100 |
| 内存泄漏 | 无 | 无 |Excerpt, first 1,640 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 0317d4c
git clone https://github.com/echoVic/boss-skill git -C boss-skill checkout 0317d4cb4f54
The author documents no install command, so this uses the repository directly. Our verdict covers commit 0317d4cb4f54 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
0317d4cb4f54
Similar skills
All testing skills →echoVic/boss-skill
后端API开发方法论,包括RESTful/GraphQL设计、请求验证、错误处理和安全实现
echoVic/boss-skill
系统架构设计方法论,包含架构模式选择、系统分层、目录结构设计
echoVic/boss-skill
需求澄清 Skill。当用户只给了模糊描述时自动触发,通过业务提问把一句话翻译成完整需求,交给 Boss 流水线执行。
echoVic/boss-skill
自动生成 CHANGELOG,基于 git 提交历史和 pipeline 产物信息,遵循 Conventional Commits 和 Keep a Changelog 规范
echoVic/boss-skill
代码审查方法,包含审查清单、常见问题、最佳实践
echoVic/boss-skill
竞品调研和分析方法,通过系统性分析竞品的功能、体验和策略,发现差异化机会
Questions about Test Strategy
What does the Test Strategy skill do?
Is Test Strategy safe to install?
What can Test Strategy access on my machine?
How current is this page?
Sources
- github.com/echoVic/boss-skill/tree/main/skill/skills/qa/test-str — the audited source at commit 0317d4cb4f54 and every finding aboveObserved · 15 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Test Strategy skill do?
- Is Test Strategy safe to install?
- What can Test Strategy access on my machine?