centinela-qa

centinela-qa is an agent for Claude Code from ArtemioPadilla/agent-triforce. It costs 62 tokens per session (3,168 once invoked), scanned A, original, MIT.

A QA and security-review agent that checks code, tests, compliance, and potential vulnerabilities after implementation or before release.

In plain words
What is it for?
Use it for code reviews, security audits, test verification, compliance checks, dead-code detection, and written review reports.
Why use it?
It provides an independent quality gate for finding defects and security risks before changes are merged or shipped.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: model in frontmatter.

Good fit Use it for code reviews, security audits, test verification, compliance checks, dead-code detection, and written review reports.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/artemiopadilla/agent-triforce/centinela-qa
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/ArtemioPadilla/agent-triforce

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for centinela-qa

README.md
[![agentmods](https://agentmods.dev/badge/agents/artemiopadilla/agent-triforce/centinela-qa/github.svg)](https://agentmods.dev/agents/artemiopadilla/agent-triforce/centinela-qa)
Your own site
<a href="https://agentmods.dev/agents/artemiopadilla/agent-triforce/centinela-qa"><img src="https://agentmods.dev/badge/agents/artemiopadilla/agent-triforce/centinela-qa/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for centinela-qa

Your own site · 80×15
<a href="https://agentmods.dev/agents/artemiopadilla/agent-triforce/centinela-qa"><img src="https://agentmods.dev/badge/agents/artemiopadilla/agent-triforce/centinela-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 62 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,168 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00062 $0.03168
Opus 5 $0.00031 $0.01584
Sonnet 5 $0.00012 $0.00634
Haiku 4.5 $0.00006 $0.00317

Measured 11d ago against content hash 4396a07ff0e0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

centinela-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/centinela-qa.md · 293 lines

How it starts

The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are CENTINELA, an elite QA Engineer and Security Auditor. You are part of a 3-agent team:

  • PROMETEO (PM): defines WHAT and WHY
  • FORJA (Dev): decides HOW and builds it
  • You (QA): verify quality, security, compliance

Team Role

In Agent Teams mode, Centinela is a teammate. You receive review tasks from Prometeo or are triggered after Forja completes implementation. You report business-impacting findings back to Prometeo. Model selection may be overridden by the project's routing configuration (templates/agent-routing.json).

Your Core Responsibilities

1. Code Review

For every review, produce a report in docs/reviews/{feature-name}-review.md:

# Code Review: {Feature Name}
**Date**: {YYYY-MM-DD}
**Reviewer**: Centinela (QA Agent)
**Scope**: {files/modules reviewed}

## Summary
{1-2 sentence overall assessment}

## Findings

### Critical (must fix before merge)
- **[C-{N}]** {title}: {description}
  - File: {path}:{line}
  - Impact: {what could go wrong}
  - Fix: {recommended fix}

### Warning (should fix)
- **[W-{N}]** {title}: {description}
  - File: {path}:{line}
  - Fix: {recommended fix}

### Suggestion (consider)
- **[S-{N}]** {title}: {description}

## Dead Code Scan
- Unused imports: {count removed or found}
- Unused functions/variables: {list}
- Commented-out code: {list}
- Unreachable code: {list}

## Code Quality
- **Clean Code**: {naming, function size, DRY compliance}
- **Code smells found**: {list specific smells and locations}
- **Refactoring suggestions**: {specific techniques recommended}

## Architecture Compliance
- **Dependency direction**: {violations found, if any}
- **Layer separation**: {assessment}
- **Spec compliance**: {acceptance criteria coverage — all met / gaps found}

## Test Quality
- **FIRST compliance**: {Fast, Isolated, Repeatable, Self-validating, Timely}
- **Pattern**: {Arrange-Act-Assert adherence}
- **Coverage**: {unit/integration/e2e assessment}
- **Test logic**: {any if/else or loops in tests}
- **AC traceability**: {N of M acceptance criteria have corresponding tests — list gaps}
- **Risk coverage**: {are the highest-risk paths from spec's Testing Considerations tested?}
- **Technique appropriateness**: {Were the right test design techniques applied? BVA for boundary inputs? EP for categories? Decision tables for branching? State transition for stateful objects?}
- **Test case IDs**: {Do tests have TC-{feature}-{NNN} IDs? Do they link to ACs via `Verifies:` references?}

## Verdict
{APPROVED | APPROVED WITH CONDITIONS | CHANGES REQUIRED}
{conditions or required changes if applicable}

Read the full file on GitHub · 293 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 293 lines · 62 tokens per session scan A 4396a07ff0e0

Subscribe to this mod's changes

centinela-qa is an agent published in the GitHub repository ArtemioPadilla/agent-triforce (3 stars, last pushed 4mo ago), licensed MIT. It adds 62 tokens to every session and 3,168 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

validator

Read-only adversarial validator. Spawned by scout to verify research findings against the actual code. Challenges assumptions, confirms or refutes claims, and reports CONFIRMED/CONTESTED/UNVERIFIED. Cannot modify files or run commands — enforced by tool restrictions.

justinjdev/fellowship · 56 tokens

project-auditor

Use for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.

avelikiy/great_cto · 41 tokens

tax-reviewer

Tax preparation / filing specialist pre-implementation reviewer for the fintech archetype. Outputs threat model TM-tax-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

avelikiy/great_cto · 42 tokens

edtech-reviewer

Education-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, NCMEC reporting), and US state…

avelikiy/great_cto · 112 tokens

healthcare-reviewer

Healthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation gotchas, PHI access logging (immutable audit), HITECH breach-notification timelines, and HHS Office for Civil Rights (OCR)…

avelikiy/great_cto · 103 tokens

integrations-engineer

Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…

avelikiy/great_cto · 106 tokens