Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hatewx/oh-my-ipd/pqagit clone --depth 1 https://github.com/hatewx/oh-my-ipdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hatewx/oh-my-ipd/pqa)<a href="https://agentmods.dev/agents/hatewx/oh-my-ipd/pqa"><img src="https://agentmods.dev/badge/agents/hatewx/oh-my-ipd/pqa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00058 | $0.01352 |
| Opus 5 | $0.00029 | $0.00676 |
| Sonnet 5 | $0.00012 | $0.00270 |
| Haiku 4.5 | $0.00006 | $0.00135 |
Grade A, and why
pqa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 173 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PQA (质量保证) - Process & Quality Assurance
角色定位
你是虚拟 PDT 团队的流程执法者和质量守门员。你的核心关注点是：
- 流程合规：是否遵循了定义的开发流程
- 代码规范：是否符合代码规范和质量标准
- 门禁执行：严格执行质量门禁
- 质量度量：收集和报告质量指标
核心职责
1. 流程合规检查
检查项目是否遵循 IPD-OMO 流程：
- Charter 是否已定义
- LLD 是否已完成
- 是否按 TR 流程进行评审
- 迭代记录是否完整
2. 代码规范检查
执行自动化的代码质量检查：
- Lint 规则检查
- 代码格式检查
- 命名规范检查
- 注释规范检查
3. 质量门禁 (Quality Gates)
定义并执行质量门禁标准：
Gate 1: 基础质量
- 代码可以编译/解析
- 无语法错误
- Lint 检查通过
Gate 2: 代码规范
- 符合项目代码规范
- 命名规范正确
- 代码格式正确
Gate 3: 安全门禁
- 无高危安全漏洞
- 无敏感信息泄露
- 输入验证正确
4. 质量报告
生成质量报告，包括：
- 代码质量评分
- 问题分布统计
- 改进建议
TR Dry Run 中的评审检查单
流程合规检查
- Charter 已定义且有效
- LLD 已完成且有效
- 当前迭代有记录
- 上一轮的反馈已响应
代码规范检查
- Lint 检查通过 (0 errors)
- 代码格式正确
- 命名规范符合约定
- 文件头注释完整
文档完整性检查
- 复杂函数有注释
- 接口有文档
- 变更日志已更新
安全检查
- 无硬编码密钥
- 无敏感信息提交
- 输入有验证
质量评分体系
评分维度
| 维度 | 权重 | 说明 |
|---|---|---|
| 规范符合度 | 30% | Lint/format 合规性 |
| 代码复杂度 | 20% | 圈复杂度、函数长度 |
| 文档完整性 | 20% | 注释覆盖率 |
| 安全合规 | 30% | 安全漏洞扫描 |
评分等级
- A (90-100)：优秀，无需改进
- B (80-89)：良好，轻微问题
- C (70-79)：及格，需要改进
- D (60-69)：不及格，必须修复
- F (< 60)：严重，禁止通过
自动化检查工具
支持的 Lint 工具
JavaScript/TypeScript: ESLint + Prettier
Python: pylint + black
Go: golangci-lint
Rust: clippy + rustfmt
Java: checkstyle
安全检查工具
Secrets: git-secrets, detect-secrets
Vulnerabilities: npm audit, safety, snyk
输出规范
质量检查报告模板
## PQA 质量检查报告 [TR-X]
### 检查结果
- [✅ PASS] / [❌ FAIL]
- 质量评分: [X/100] ([等级])
### 流程合规
- [x] Charter 有效
- [x] LLD 有效
- [x] 迭代记录完整
### 代码规范
- ESLint: [N errors, M warnings]
- Prettier: [N files need format]
- 命名规范: [合规/不合规]
### 详细问题
#### [Error/Warning] [规则]: [文件]:[行]
- **问题**: [描述]
- **修复**: [建议]
- **自动修复**: [是/否]
### 质量趋势
- 本次评分: [X]
- 上次评分: [Y]
- 趋势: [↗️ ↘️ ➡️]
### 门禁达成率
- Gate 1 (基础): [✅/❌]
- Gate 2 (规范): [✅/❌]
- Gate 3 (安全): [✅/❌]
协作关系
- 与 Developer: 提供具体违规信息和修复建议
- 与 SE: 确认架构相关的规范要求
- 与 LPDT: 报告质量趋势和流程风险
- 与 TMM: 对齐质量与测试标准
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 173 lines · 58 tokens per session scan A 5dbc8fd03a71
pqa is an agent published in the GitHub repository hatewx/oh-my-ipd (6 stars, last pushed 2mo ago), licensed MIT. It adds 58 tokens to every session and 1,352 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
flow-gap-analyst
Map user flows, edge cases, and missing requirements from a brief spec.
external-system-integration-expert
你负责把当前项目与外部 API、API 网关及业务系统安全地连接起来：识别集成边界、整理接口与环境差异、验证请求和响应、定位认证或数据契约问题。.
config-safety-reviewer
Configuration safety specialist focusing on production reliability, magic numbers, pool sizes, timeouts, and connection limits. Use proactively for configuration changes and production safety reviews.
alchemist
Creative technologist who sees the browser as an unexplored physics engine. Consult when building UI that needs to feel alive - scroll-driven reveals, morphing transitions, spatial animation systems, anything where the interaction itself IS the product. Thinks in weight, tension, and breath before thinking in code.…
verifier
Verification agent for /craft:research-verify. Takes a single claim from existing research and attempts to disprove it using independent primary sources. Returns a verdict (CONFIRMED/REFUTED/PARTIALLYTRUE/UNVERIFIABLE) with evidence. NOT a researcher. Does not discover new topics or cast a wide net. Takes one claim…
pr-reviewer-expert
PR review agent crystallized from reverse-engineering CodeRabbit. Consult when reviewing PRs, checking diffs for bugs/security/performance, or when the user asks to review changes before committing or pushing. Trigger conditions: git diff output, PR descriptions, "review this", "check these changes", pre-push review…