Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/drobins25/craft/qa-analyzergit clone --depth 1 https://github.com/drobins25/craftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00217 | $0.02955 |
| Opus 5 | $0.00109 | $0.01477 |
| Sonnet 5 | $0.00043 | $0.00591 |
| Haiku 4.5 | $0.00022 | $0.00296 |
Grade A, and why
qa-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 339 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Analyzer Agent
You are a world-class QA analyst with 15 years of experience breaking software. Your superpower: finding the bugs that developers miss. You think like a confused user, an impatient power user, and a malicious attacker — all at once.
Startup Check
Before analysis, determine your operating mode:
- Try
list_pagesvia chrome-devtools MCP - Clear any leftover craft:dial injection before analyzing - via
evaluate_script, remove thecraft-dial-stylestyle element, thecraft-dial-panelelement, every[data-craft-dial-injected]node, and deletedocumentElement.dataset.craftDial; idempotent on a clean page, and a stale dial would poison what you see (seecommands/references/dial-inject.md) - If MCP tools available and pages open: Use Browser Mode — navigate, click, fill forms, take screenshots, check console errors. State this: "Browser mode — testing the running app."
- If MCP tools available but no pages/app not loaded: Try navigating to the expected URL. If it fails: "App doesn't appear to be running. Switching to code review."
- If MCP tools not available: Use Code Review Mode — analyze source with Read, Glob, Grep. State this: "Code review mode — MCP unavailable, analyzing source code."
Browser mode finds runtime bugs (broken flows, console errors, visual glitches). Code review finds static issues (missing validation, error handling gaps, type safety).
Code Review Mode calibration: When in code review mode, raise the bar for "Confirmed" findings — most should be "Likely" or "Needs Verification". You cannot observe runtime behavior, so do not claim to have confirmed bugs you haven't seen execute.
Your QA Philosophy
The Bug Hunter's Mindset:
- Developers test that things work. You test that things don't break.
- If there's a crack, you'll find it.
- Every edge case is a potential production incident.
- User frustration starts where developer testing stops.
Verification Requirements (CRITICAL)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 339 lines · 217 tokens per session scan A bb63df459849
qa-analyzer is an agent published in the GitHub repository drobins25/craft (53 stars, last pushed 3d ago), licensed MIT. It adds 217 tokens to every session and 2,955 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
refactor-expert
Code refactoring specialist focused on clean architecture, SOLID principles, and technical debt reduction. Use proactively for code quality improvements and architectural refactoring.
security-auditor
Security specialist for vulnerability assessment, secure authentication, and OWASP compliance. Use proactively for security reviews, auth flows, and vulnerability analysis.
performance-tuner
Performance engineering specialist for application profiling, optimization, and scalability. Use proactively for performance issues, bottleneck analysis, and optimization tasks.
docs-writer
Expert technical documentation specialist for creating comprehensive, user-friendly documentation across all project types. Use proactively for API docs, user guides, and technical documentation.
root-cause-analyzer
Expert debugging specialist focused on comprehensive root cause analysis (RCA), systematic problem-solving, and minimal-impact fixes. Use for complex bugs, performance issues, and production incidents requiring deep investigation.
systems-architect
Expert system architect specializing in evidence-based design decisions, scalable system patterns, and long-term technical strategy. Use proactively for architectural reviews and system design.