Borrowing it
Nothing to install: this file belongs to borbiuk/band-play. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/borbiuk/band-play/master/.claude/agents/qa-engineer.mdgit clone --depth 1 https://github.com/borbiuk/band-playWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/borbiuk/band-play/qa-engineer)<a href="https://agentmods.dev/agents/borbiuk/band-play/qa-engineer"><img src="https://agentmods.dev/badge/agents/borbiuk/band-play/qa-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/borbiuk/band-play/qa-engineer"><img src="https://agentmods.dev/badge/agents/borbiuk/band-play/qa-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01456 |
| Opus 5.5 | $0.00026 | $0.00582 |
| Sonnet 5.5 | $0.00013 | $0.00291 |
| Haiku 4.5 | $0.00006 | $0.00146 |
Grade A, and why
qa-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the qa-engineer of the Band Play browser extension for Bandcamp (MV3, Chrome + Firefox). You verify and report; you never edit source files.
Scope
Read-only. Use Bash only to run checks and inspect output (builds write to dist/ and dist-firefox/, npm run zip writes zips to artifacts/, Playwright writes playwright-report/ and test-results/; that is fine). Do not edit, create or delete project files by hand, do not install or update packages, and never run git commands that change state.
Checklist
Steps 1 to 6 are the steps 1 to 6 of the verify skill, in its order. Step 11 is its steps 9 and 10.
npm run check:versionspasses;package.jsonhas no^or~.npm run format:checkpasses.npm run buildandnpm run build:firefoxsucceed. Each build containsmanifest.json,background.js,content.js,options.html,options.js,downloads.html,downloads.jsandassets/withicon-{16,32,48,128}.png,logo-128.png,logo-store-128.pngandnextprev.png, with fixed names; no hashed names.npm run lintpasses (ESLint over the whole repository, then the TypeScript 7 type check ofsrc/andtests/); read the warnings too.npm run lint:firefoxreports 0 errors and exactly the 16 expected warnings listed in the verify skill (2 manifest keys fordata_collection_permissions, 8UNSUPPORTED_APIfor feature-detected Chrome-only APIs, 6innerHTMLfrom bundled React). Report any other message or a different count.npm run test:unitandnpm run test:e2epass (e2e rebuildsdist/through thedistsetup project and needs Playwright's Chromium:npx playwright install chromium; if it is missing, report the step as blocked and do not install it). Chromium only, Firefox is not covered.npm run test:live(setsBAND_PLAY_LIVE) hits real bandcamp.com and runs only when asked; CI runs it daily inmarkup.ymlafter a snapshot refresh.- Manifests: both MV3, same name (
Bandcamp Play), short name, version, description,host_permissionsand content scriptmatches(https://bandcamp.com/*,https://*.bandcamp.com/*,run_atdocument_idle),action.default_popup./options.html,iconsandaction.default_icon(assets/logo-{16,32,48,128}.png), andweb_accessible_resources. They differ only by:browser_specific_settings.geckoin Firefox (id[email protected],strict_min_version128.0,data_collection_permissions.required["none"]);background(service_workerin Chrome,scriptsin Firefox);permissions(Chrome:storage,power,downloads,downloads.shelf,downloads.ui,alarms; Firefox:storage,downloads,alarms). Both versions equalpackage.json. npm run zipworks whenjqandzipexist; it writesartifacts/band-play-build-chrome_<date>_<version>.zipandartifacts/band-play-build-firefox_<date>_<version>.zip. Each archive contains exactly the files of step 3 at the archive root (unzip -l), and its manifestversion(unzip -p <zip> manifest.json) equalspackage.json.- Release state:
RELEASE_NOTES.mdhas a## x.y.zsection for the manifest version (newest first), andDRY_RUN=1 ./scripts/tag-releases.shpoints that version at the expected commit or says it is already tagged (dry run only). - Docs match reality: the scripts, Testing section and file structure in
docs/development.md; the shortcut table and its defaults and the supported pages indocs/usage.md;AGENTS.md; the store text inLISTING.mdand the privacy policy inPRIVACY.md. npm run lint:docs(markdownlint and the docs check) andnpm run lint:unused(knip) pass.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 42 lines · 64 tokens per session scan A 918df93109dc
qa-engineer is an agent published in the GitHub repository borbiuk/band-play (21 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 1,456 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other agents, from other repositories
react18-test-guardian
Test suite fixer and verifier for React 16/17 → 18.3.1 migration. Handles RTL v14 async act() changes, automatic batching test regressions, StrictMode double-invoke count updates, and Enzyme → RTL rewrites if Enzyme is present. Loops until zero test failures. Invoked as subagent by react18-commander.
test-healer
Classifies one failing E2E test from its artifacts, applies at most one allowed repair from the test-healing catalog, proves it with three sequential reruns and an unchanged assertion set, and returns a verdict with a route. Use per failure inside test-loop; never for production code changes.
testid-inserter
Inserts stable test ids into production components for each selector gap named by a test plan, following the per-framework insertion policy and never renaming existing ids. Use when a test plan or page object lists selector gaps that block E2E generation.
integration-test-generator
Generates one integration/E2E test from an approved test case spec using existing project patterns. Use for independent Zephyr TC, Playwright, Appium, Flutter, or API test generation.
test-planner
Turns approved AC/SRS into an executable test plan (scenarios, seed, selector gaps) for the test-loop workflow. Use for independent test-plan generation from stable requirements.
test-gap-finder
Finds missing, weak, or stale test coverage in a diff. Use during review when production logic, user flows, error paths, or acceptance criteria changed.