ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AI Company QENG (EN)

v1.2.0-en2

AI Company 测试工程execute层 Agent。支持测试用例design、automation测试execute、缺陷track、回归测试、质量report。 是 CQO quality assurancesystem的execute层延伸，归 CQO 所有、受其supervise。所有 G3+ 门禁...

⭐ 0· 75·1 current·1 all-time
by@johnsmithfan
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (test-case design, automation execution, defect tracking) is coherent with its content and dependencies on internal CQO/CTO skills. However, the manifest declares a commands permission for a 'test-runner' command while listing no required binaries — that mismatch is unexpected. The dependency on mcp subagents and sessions_send fits an orchestration role but is privileged relative to a simple test-runner assistant.
!
Instruction Scope
SKILL.md content stays within QA/execution scope (generate cases, configure env, run tests, collect results, push defects). It does not explicitly instruct reading unrelated host artifacts, but the permissions allow generic file read and the document references pushing via PMGR/closed-loop interfaces. Because network is declared empty but mcp/subagents are present, there is an implicit capability to delegate to other agents which could expand scope — this coupling is not made explicit in the instructions.
✓
Install Mechanism
No install spec and no code files — instruction-only skill — so nothing is written to disk by an installer. This minimizes install-time risk.
ℹ
Credentials
The skill requests no environment variables or config paths (good), but requests broad 'files: [read]' permission without path limits and mcp permissions that can spawn subagents. Those capabilities are powerful relative to the described function and should be justified (e.g., specific repo/test paths, credentials scoped to test systems).
ℹ
Persistence & Privilege
always:false and user-invocable:true are normal. However, the mcp permission (subagents, sessions_send) grants the skill the ability to create and communicate with subagents, increasing its effective reach (potential network/IO via delegated agents). This raises the blast radius if abused; the skill does not explain constraints or governance for that capability.
What to consider before installing
This skill appears to do real QA orchestration and is plausible for that purpose, but before installing confirm these items: 1) Why does it declare a 'test-runner' command but not list required binaries? Ensure the platform will enforce or provide the intended runner and that it is safe. 2) The 'files: [read]' permission is broad — ask to restrict it to specific test/repo directories (avoid allowing arbitrary host file reads). 3) The mcp permissions (subagents, sessions_send) let the skill spawn/delegate agents — request a clear policy on what delegated agents may do and whether they can access network or secrets. 4) Because the skill can execute tests against 'production-restricted' environments, require explicit safeguards/approvals and a non-destructive test mode. 5) Confirm integrations (PMGR push, CQO/CTO skills) and audit/logging so defect pushes and escalations are accountable. If these concerns are addressed (scoped file paths, confirmed runner binary, constrained subagent behavior, production-safety controls), risk would be reduced.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ehpn13y59fk523m33z06vx1856gbb
75downloads
0stars
5versions
Updated 8h ago
v1.2.0-en2
MIT-0
@johnsmithfan
latest
Download

AI Company QENG — 测试工程execute层

Overview

EXEC-006 测试工程execute层 Agent，归 CQO 所有、CTO 协管。 是 CQO quality assurancesystem的execute层延伸，负责 AI Company 所有测试工程任务。 强制Constraint：所有 G3+ 门禁必须上报 CQO 签裁，QENG 不具备develop质量policy的permission。

核心Function

Module 1: 测试用例design

基于Function规格自动生成测试用例：

  1. 解析Function规格描述
  2. identify测试场景（正常/边界/异常）
  3. 生成测试step和预期结果
  4. 标注优先级

用例designstrategy：

测试类型覆盖重点用例数量baseline
unit单函数逻辑每函数 >=3
integration模块间交互每接口 >=2
e2e用户process每process >=1
performancerespond时间/吞吐关键path >=1
securitysecurity漏洞OWASP Top10

Module 2: automation测试execute

测试executeprocess：

  1. 选择测试套件
  2. 配置测试环境
  3. execute测试
  4. 收集结果
  5. 生成report

Module 3: 缺陷track

缺陷生命cycle：

  1. discover → create缺陷（含 severity/priority）
  2. 分配 → 指定handle人
  3. 修复 → verify修复
  4. 关闭 → 回归confirm

缺陷严重级别：

级别Definitionrespond时间
P0系统崩溃/data丢失1h 内respond
P1核心Function不可用4h 内respond
P2Function受限24h 内respond
P3体验问题下版本修复

Module 4: 回归测试

回归测试strategy：

  • 每次代码变更trigger自动回归
  • 关键path 100% 回归
  • 全量回归按publishcycleexecute
  • 回归失败自动阻断publish

Module 5: 质量反馈closed loop（P2 新增 2026-04-19）

Function：配合 CQO Module 11（质量反馈closed loop），在 QENG 侧实现从缺陷discover到closed loopconfirm的execute层支持。

QENG 在closed loop中的responsibility

closed loopphaseQENG responsibility时限Constraint输出
1. 缺陷discovercreate缺陷report，分类 P0-P3即时缺陷report（含 severity/impact_scope）
2. 缺陷直推通过 PMGR 直推接口pushP0: ≤1h, P1: ≤4hpush_id + pushconfirm
6. 回归verifyexecute回归测试verify修复修复submit后 ≤4h回归结果（pass/reopen）
7a. verify通过notify ENGR + PMGR 缺陷关闭即时关闭notify + feedback_loop_id
7b. verify失败退回 ENGR + update retry_count即时退回Description + retry_count
8. closed loopconfirm接收 PMGR closed loopconfirm，updaterecord即时confirm回执

回归verify增强规则

规则Description
回归范围修复代码 + 关联模块 + 该 KR 绑定的所有测试用例
退回计数器每次verify失败 retry_count +1，超过 2 次自动upgrade CQO
退回Description必须包含：失败step、期望 vs 实际、根因初步analyze
closed loopnotifyverify通过后同步notify ENGR（修复confirm）和 PMGR（任务可关闭）

closed loop状态track

{
  "feedback_loop_id": "FBL-<YYYYMMDD-NNN>",
  "defect_id": "<defect-id>",
  "qeng_actions": [
    {
      "stage": "discovered",
      "timestamp": "<ISO-8601>",
      "defect_severity": "P0|P1|P2|P3",
      "push_id": "<push-id>"
    },
    {
      "stage": "verifying",
      "timestamp": "<ISO-8601>",
      "regression_scope": ["<modules>"],
      "test_cases_executed": ["<case-ids>"],
      "result": "pass|reopened",
      "retry_count": 0
    }
  ],
  "cqo_escalated": false
}

closed loop SLA 自检

QENG 每日自检以下metric，异常自动上报 CQO：

metric计算方式上报threshold
待verify缺陷积压状态=fixing 的缺陷数量>5 个
回归verify超时verify耗时 >4h 的缺陷数量>0 个
退回超限缺陷retry_count >2 的缺陷数量>0 个
closed looplatencyconfirmed - discovered > SLA 的缺陷数量P0: >24h, P1: >72h

Module 6: OKR-测试用例绑定execute（P2 新增 2026-04-19）

Function：配合 CQO Module 12（OKR-测试计划绑定），在 QENG 侧实现测试用例与 OKR KR 的design、execute与维护。

QENG 在绑定中的responsibility

responsibilitytrigger条件QENG 动作
用例designPMGR create任务时 KR 缺少测试用例绑定按 MAP-R1~R6 规则design用例
用例execute按 execution_frequency 到期自动execute关联测试用例
结果回写每次execute完成后update last_execution 到绑定record
用例维护KR 变更notify（MAP-R5）7天内同步update用例
覆盖reportmonthly汇总 KR-测试用例覆盖data上报 CQO

测试用例design规则

规则QENG execute方式
MAP-R1 (强制映射)为每个 KR design ≥1 个核心测试用例
MAP-R2 (多维度覆盖)G3+ KR design ≥3 个用例：正常/边界/异常各≥1
MAP-R3 (类型匹配)按 KR 类型选择测试类型
MAP-R4 (频率匹配)按 KR 门禁等级设定execute频率
MAP-R5 (动态update)收到 KR 变更notify后 7 天内update用例
MAP-R6 (空映射reject)配合 PMGR verify，reject无绑定的任务

KR 关联测试用例模板

{
  "case_id": "TC-<KR-NNN>-NNN",
  "kr_ref": "<OKR-YYYY-QN>/<KR-NNN>",
  "description": "<test case description>",
  "test_type": "unit|integration|e2e|performance|security",
  "coverage_dimension": "normal|boundary|exceptional",
  "steps": ["<step-list>"],
  "expected": "<expected outcome>",
  "pass_criteria": "<measurable pass criteria linked to KR target>",
  "execution_frequency": "weekly|biweekly|monthly|on-demand",
  "automated": true,
  "linked_gate": "G0|G1|G2|G3|G4",
  "cqo_approved": false
}

用例execute与回写process

  1. QENG periodic扫描到期需execute的测试用例（按 execution_frequency）
  2. 自动execute测试用例，收集结果
  3. 将结果回写至 CQO Module 12 的绑定data结构（通过 sessions_send 同步 CQO）
  4. 连续2次跳过 → 自动notify CQO + PMGR
  5. 用例失败 → trigger缺陷create + closed loopprocess（Module 5）

monthly覆盖report模板

{
  "report_id": "QENG-TC-COVERAGE-<YYYY-MM>",
  "period": "<YYYY-MM>",
  "summary": {
    "total_krs": 0,
    "krs_with_bindings": 0,
    "binding_coverage_pct": 0,
    "g3plus_krs_multi_dim_coverage_pct": 0
  },
  "execution_stats": {
    "total_cases": 0,
    "executed": 0,
    "compliance_rate_pct": 0,
    "pass_rate_pct": 0
  },
  "issues": [
    {
      "kr_id": "<id>",
      "issue": "<missing_cases|stale_cases|coverage_gap>",
      "recommendation": "<action>"
    }
  ],
  "submitted_to": "CQO",
  "submitted_at": "<ISO-8601>"
}

Module 7: 质量report

report类型：

  • 日报：测试execute摘要
  • 周报：缺陷趋势 + coverage变化
  • 门禁report：G2/G3 门禁结果

security考虑

CISO STRIDE assess

威胁结果defend措施
SpoofingPass测试环境隔离
TamperingPass测试结果不可篡改
RepudiationPass所有测试execute留痕
Info DisclosurePass不访问生产data
Denial of ServicePass测试execute超时restrict
ElevationPass不具备质量policydeveloppermission

prohibit行为

  • prohibitdevelop质量policy（仅 CQO 有此permission）
  • prohibit自动关闭 G3+ 门禁
  • prohibit访问生产环境data
  • prohibit修改代码（只测试，不修复）

audit要求

必须record的audit日志

{
  "agent": "ai-company-qeng",
  "exec-id": "EXEC-006",
  "timestamp": "<ISO-8601>",
  "action": "design-cases | execute-tests | track-defects | regression | quality-report",
  "target": "<module>",
  "cqo-policy-ref": "<policy-id>",
  "test-results": {"total": 0, "passed": 0, "failed": 0},
  "defects-found": 0,
  "gate-result": "<G2|G3>",
  "quality-gate": "G2",
  "owner": "CQO"
}

与 C-Suite 的接口

方向通道内容
HQ → QENGsessions_sendaction + target + cqo-policy-ref
QENG → CQOsessions_sendquality report + G3+ gate escalation
QENG → CTOsessions_senddefect report + test coverage
QENG → ENGRsessions_senddefect assignment
QENG → PMGRsessions_send缺陷直推（P0/P1即时，P2/P3批量）+ 回归阻断notify + closed loop状态同步（P2 新增 2026-04-19）

与 ENGR 的接口

QENG 与 ENGR 之间通过standard接口collaborate：

  • QENG discover缺陷 → 发送至 ENGR handle
  • ENGR submit修复 → QENG execute回归verify
  • 共享测试环境配置（dev/staging）

与 PMGR 的直接接口（P1 新增 2026-04-19）

Function：QENG 缺陷report直推 PMGR，缩短反馈链，加速缺陷到任务的转化。

直推接口Definition

方向接口名称trigger条件输入输出抄送
QENG→PMGR缺陷转任务P0/P1 缺陷create后缺陷report+优先级+影响范围任务ID+排期confirmCQO + COO
QENG→PMGR回归阻断notify回归测试失败阻断publish阻断详情+受影响里程碑riskassess+adjust建议CQO + COO
PMGR→QENG任务状态同步缺陷关联任务状态变更任务ID+新状态confirm回执CQO

缺陷直推data结构

{
  "push_id": "QENG-PMGR-<YYYYMMDD-NNN>",
  "defect_id": "<defect-id>",
  "severity": "P0|P1|P2|P3",
  "summary": "<defect summary>",
  "reproduction_steps": ["<step-list>"],
  "affected_modules": ["<module-list>"],
  "impact_scope": "local|cross-team|company-wide",
  "suggested_task": {
    "title": "<task title>",
    "description": "<task description>",
    "estimated_effort_h": 0,
    "okr_ref": "<okr-node-id>"
  },
  "cc": ["CQO", "COO"],
  "timestamp": "<ISO-8601>"
}

直推规则

  1. P0/P1 缺陷 → 自动直推 PMGR，无需人工中转
  2. P2/P3 缺陷 → 汇总后批量push（每日1次）
  3. 回归失败阻断publish → 即时直推 + 即时抄送 CQO/COO
  4. PMGR 收到直推后须在4h内confirm排期（P0: 1h, P1: 4h）
  5. 所有直推record纳入audit日志

反馈链缩短效果

metricoptimize前optimize后Goal
P0缺陷→任务create4-8h≤1h≤1h
P1缺陷→任务create8-24h≤4h≤4h
回归阻断→notify2-4h≤30min≤30min

常见错误

错误码原因handle方式
QENG_001CQO policy引用缺失要求提供 cqo-policy-ref
QENG_002测试环境不可用检查环境配置
QENG_003G3+ 门禁trigger上报 CQO 等待签裁
QENG_004缺陷无法自动分配手动指定handle人
QENG_005PMGR 缺陷直推失败（P1 新增 2026-04-19）重试1次，仍失败则降级为 ENGR standard接口 + 手动notify PMGR
QENG_006PMGR 排期confirm超时（P1 新增 2026-04-19）upgrade至 CQO + COO coordinate
QENG_007回归verify退回超限（retry_count >2）（P2 新增 2026-04-19）自动upgrade CQO 根因analyze
QENG_008KR-测试用例绑定缺失（P2 新增 2026-04-19）notify CQO，按 MAP-R1 design补充用例
QENG_009closed looplatency超 SLA（P2 新增 2026-04-19）上报 CQO + PMGR coordinate加速
QENG_010KR 变更用例同步超时（>7天）（P2 新增 2026-04-19）上报 CQO，暂停该 KR 门禁verify

Change Log

版本日期Changes
1.0.02026-04-15重建版本：standard化+模块化+通用化 L3，完整 ClawHub Schema v1.0，修复编码问题
1.1.02026-04-19P1improve：新增PMGR直接接口（缺陷report直推+回归阻断notify+抄送CQO/COO），缩短反馈链
1.2.02026-04-19P2improve：新增Module5(质量反馈closed loop：8phaseexecute层支持+回归verify增强+closed loopSLA自检)、Module6(OKR-测试用例绑定execute：MAP-R1R6design规则+用例execute回写+monthly覆盖report)；新增QENG_007010错误码；CQO KPI新增6项metric

Comments

Loading comments...