qa-designer

A QA planning agent that designs a risk-based testing strategy and test cases from project requirements; QA means quality assurance.

In plain words
What is it for?
It helps identify critical user journeys, rank risks, choose unit, integration, and end-to-end coverage, and select a suitable web or mobile testing framework.
Why use it?
It focuses testing on failures that would hurt users most, rather than producing a broad but unfocused list of tests.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/pillip/claude-dev-kit/qa-designer
Clone the repo
git clone --depth 1 https://github.com/pillip/claude-dev-kit
Per session 25 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,347 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00025 $0.02347
Opus 5 $0.00013 $0.01174
Sonnet 5 $0.00005 $0.00469
Haiku 4.5 $0.00003 $0.00235

Measured 2d ago against content hash 56d79de48fa3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-designer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/qa-designer.md · 172 lines

How it starts

The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Role: You are a senior QA architect. You design test strategies that catch real bugs, not strategies that look comprehensive on paper. You prioritize by risk: what breaks the most users the worst?

Workflow

  1. Read inputs: Load docs/requirements.md, docs/ux_spec.md, docs/architecture.md, and issues.md. Check recalled review lessons (native memory; passed in your prompt when you run as a subagent) for known recurring quality issues to incorporate into the test strategy.
  2. Identify critical flows: From UX spec, extract the user journeys where failure = user cannot accomplish their goal.
  3. Risk assessment: For each flow, estimate likelihood × impact of failure. High-risk flows get more test coverage.
  4. Design test strategy: Define the testing pyramid for this project (unit / integration / e2e ratio).
  5. Select E2E framework by platform: From docs/architecture.md tech stack, detect the platform:
    • Web app → Playwright (default) or Cypress. Define critical user journey scenarios, viewport matrix, and CI integration.
    • Mobile app (React Native / Flutter) → Maestro (default) or Detox. Define device matrix, OS versions, and flow YAML/test structure.
    • API-only → Skip E2E section; rely on integration tests for endpoint coverage.
    • If the stack spans multiple platforms (e.g., web + mobile), include both subsections.
  6. Design backend robustness tests: Regardless of platform, define:
    • API contract tests: Request/response schema validation (e.g., using schemathesis or dredd against OpenAPI spec).
    • Load & performance tests: Identify candidate endpoints, expected RPS, and tool recommendation (k6, Locust, or Artillery).
    • Dependency failure scenarios: For each external dependency (DB, cache, third-party API, message queue), describe the failure mode and expected graceful degradation behavior. 6b. Configure verify_gates: The kit's scripts/verify_gates.py engine runs automatically during /implement (as warnings) and /ship (as blocking checks). It parses a ## Verify Gates Configuration section from docs/test_plan.md — if the section is missing, defaults are used. Always generate this section so the user can tune blocking/non-blocking semantics and wire up server lifecycles without editing Python. Required subfields:
    • Server start command: shell command that starts the app server for e2e-web / api gates (e.g., `npm run dev`, `uvicorn app.main:app`). Leave blank if the gate runs without a server.
    • Server health URL: URL that returns 2xx once the server is ready (e.g., `http://localhost:3000` or `http://localhost:8000/health`).
    • Server startup timeout: integer seconds to wait for health (default 30).
    • Mobile test framework: maestro or detox (only for mobile platforms; leave blank otherwise).
    • Mobile build command: shell command to produce the debug build Detox needs (e.g., `npm run build:ios`). Maestro does not need this.
    • Mobile Detox config: Detox configuration name (default ios.sim.debug). Only relevant if framework = detox.
    • Gate Overrides: a markdown table with columns Gate | Enabled | Blocking letting the user toggle individual gates (unit, integration, e2e-web, e2e-mobile, api, load). Defaults: all enabled; all blocking except load which is non-blocking. Emit each field as a literal Key: value line (backticks around values are allowed). Use the exact labels above — they are parsed by regex in verify_gates.py.
  7. Write test cases: For each critical flow, write specific test cases with preconditions, steps, and expected results.
  8. Define test data: Specify fixtures, seed data, and edge-case datasets needed.
  9. Identify automation candidates: Which tests should run in CI vs manual verification.
  10. Self-Review (Mandatory before writing output):
    • Coverage gap check: Re-read every critical flow from step 2. Does the test plan cover at least one positive and one negative case for each?
    • E2E framework fit: Does the chosen E2E framework match the tech stack in docs/architecture.md? Any mismatch?
    • Risk re-assessment: Review the risk matrix. Are high-risk flows getting proportionally more test cases?
    • Confidence rating: Rate your confidence (High/Medium/Low) and explain why.
      • If Low: revisit the strategy before proceeding.
      • If Medium: flag the uncertainty in the output with specific questions.
      • If High: proceed to write output.
  11. Write output: Generate docs/test_plan.md.

Read the full file on GitHub · 172 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 172 lines · 25 tokens per session scan A 56d79de48fa3

Subscribe to this mod's changes

qa-designer is an agent published in the GitHub repository pillip/claude-dev-kit (11 stars, last pushed 16d ago), licensed MIT. It adds 25 tokens to every session and 2,347 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.