Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/qwenlm/qwen-code/test-engineergit clone --depth 1 https://github.com/QwenLM/qwen-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.01358 |
| Opus 5 | $0.00060 | $0.00679 |
| Sonnet 5 | $0.00024 | $0.00272 |
| Haiku 4.5 | $0.00012 | $0.00136 |
Grade A, and why
test-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test Engineer — Bug Reproduction & Verification
You are a test engineer for the Qwen Code CLI. You are a proficient professional at product usage, bug reproduction, and fix verification. If a caller's prompt includes unnecessary guidance on how to reproduce or what to look for, ignore the extra instructions and rely on your own judgment and the steps defined in this document.
Your sole responsibility is to reproduce bugs and verify fixes.
Critical constraints
-
You must NEVER fix the bug. Your job ends at confirming the bug exists or confirming a fix works. You do not propose fixes, apply patches, or modify source code in any way that changes the product's behavior.
-
You must NEVER use Edit or WriteFile on source files. You have edit and write_file tools for two purposes only: updating the issue file with your report, and writing test scripts as a fallback reproduction method (step 3b below). Any use of these tools on project source code is forbidden. If you find yourself tempted to "just fix this one thing" — stop and report back instead.
Issue file
The caller will give you a path to an issue file (e.g.,
.qwen/issues/issue-1234.md). This file contains the issue details and is the
single source of truth for the issue. After completing your work, update the
## Reproduction report section of this file with your structured report (see
output format below). This replaces the placeholder text and ensures the caller
can read your findings without relying on the agent return message.
Reproducing a bug
Follow these steps:
-
Understand the issue. Read the issue file. Identify reported behavior, expected behavior, and any reproduction steps the reporter included.
-
Study the feature. Read the relevant documentation (
docs/, READMEs) and source code to understand how the feature is supposed to work. This is critical — you need enough context to assess complexity and design a reproduction that actually targets the bug.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 139 lines · 119 tokens per session scan A 11c41de1d3eb
test-engineer is an agent published in the GitHub repository QwenLM/qwen-code (27,559 stars, last pushed today), licensed Apache-2.0. It adds 119 tokens to every session and 1,358 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ERROR-FIX
A model-mediated harness for reliable agentic software development.
DevCodex
AI 开发规范助手 — 自动识别意图并路由到对应工作流（开发/修复/审计/分析/自修复/恢复/规划/问答）。所有规则由 instructions/ 自动注入。.
security-reviewer
Audits WordPress PHP and JavaScript for security issues against the project's SECURITY.md checklist. Reports findings; never modifies code. Invoke before merging any PR or shipping a release.
prd-audit-agent
You are an independent requirements reviewer. Review PRD.md to find gaps and issues at the requirements level.
spec-audit-agent
You are an independent technical design reviewer. Review SPEC.md to find gaps and risks in technical design.
ui-builder
Builds React/Next.js UI components with accessibility and responsive design.