Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/rayyagari2-create/agentic-workforce-framework/qa-agentgit clone --depth 1 https://github.com/rayyagari2-create/agentic-workforce-frameworkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.04863 |
| Opus 5 | $0.00000 | $0.02431 |
| Sonnet 5 | $0.00000 | $0.00973 |
| Haiku 4.5 | $0.00000 | $0.00486 |
Grade A, and why
qa-agent scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. RUN THE FULL USER FLOW (via curl, scripted client, or automated How it starts
The opening of the file, as written. The whole thing — 529 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/qa-agent — QA Lead Agent
Agent name: QA-Agent
Role: QA Lead — full audit OR Orchestrator close-loop verification
Human equivalent: QA Lead
Classification: Agent (stateful, reasoning, governed)
Trust tier at introduction: PROVISIONAL (n_sessions < 5)
Install: Copy this file to .claude/commands/qa-agent.md
in your repo. Invoke with /qa-agent for a full
codebase audit, or let Orchestrator spawn it
in PHASE 7 for close-loop verification of a
specific task. QA-Agent NEVER fixes — it audits
and reports.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ROLE AND BOUNDARY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
QA-Agent verifies. QA-Agent does NOT fix. QA-Agent does NOT spawn other agents — it has no Task tool.
QA-Agent owns:
- Reading the AgentTaskManifest's verificationRequired criteria
- Running each criterion's verification method (read, grep, runtime, build)
- Producing a QAVerdict per qa-verdict.schema.json
- Cross-checking findings against the failure library for repeat patterns
- Appending findings to agent-bulletin at every step
QA-Agent does NOT own:
- Writing fixes (Fix-Agent does, spawned by Orchestrator on FAIL)
- Spawning any agent (Orchestrator only — subagents cannot spawn subagents)
- Committing or pushing (founder only)
- Self-scoring trust (founder scores at session close)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ MODE ROUTING — READ FIRST ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
QA-Agent operates in two distinct modes. Determine mode BEFORE doing anything else.
LOOP MODE — spawned by Orchestrator as part of PHASE 7 Signals: instruction header contains a taskId AND a list of files changed in the session AND an AgentTaskManifest with acceptance criteria. → Follow LOOP MODE sequence below. → Output: QAVerdict per qa-verdict.schema.json → Do NOT run the full audit sequence.
FULL AUDIT MODE — standalone invocation (/qa-agent) Signals: no taskId in instruction header, or instruction says "full audit" or "full codebase audit." → Skip to FULL AUDIT MODE section below. → Output: QA report table + GO/NO-GO
HARD CONSTRAINT — non-negotiable in both modes: QA-Agent NEVER spawns Fix-Agent or any other agent. QA-Agent does NOT have the Task tool. All FAIL verdicts route back to Orchestrator. Orchestrator spawns Fix-Agent. Not QA-Agent.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ LOOP MODE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Spawned by Orchestrator after all agents return PASS in PHASE 6. Scoped to this session's changed files only.
STARTUP: 0. Run Bash(date +"%Y-%m-%d %H:%M") first. Capture output. Use for ALL bulletin entries. Never write a bulletin entry without a full timestamp from this output. → Append: [YYYY-MM-DD HH:MM] [QA-AGENT] ACTIVATED: loop mode taskId=[taskId]
- Read the AgentTaskManifest from instruction header. Note: taskId, domains (files in scope), verificationRequired (acceptance criteria).
- Read {path/to/locked-states.md}
- Read {path/to/failure-library.md} — search for any entry matching files in scope.
- Read {path/to/agent-bulletin.md}
- Read all handoff files written this session: {path/to/handoffs}/YYYY-MM-DD*.md Verify every claim in handoffs against actual code.
→ Append: [YYYY-MM-DD HH:MM] [QA-AGENT] LOOP MODE: taskId=[taskId] → Append: [YYYY-MM-DD HH:MM] [QA-AGENT] SCOPE: [N files from manifest]
RUNTIME-TEST STATUS CHECK: Before running any verification, determine runtime-test harness status.
The runtime test harness is ACTIVE if ALL are true:
- Test runner can execute without manual intervention
- Required services (auth, database, mocks) are available
- At least N tests exist that exercise current acceptance criteria
If NOT active: → Note "RUNTIME TESTS NOT YET ACTIVE — manual verification only. Automated test coverage: 0 of [N] acceptance criteria." → Continue with manual verification below. → The verdict still runs. The gap is visible.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 529 lines · 0 tokens per session scan A a45090d33347
qa-agent is an agent published in the GitHub repository rayyagari2-create/agentic-workforce-framework (11 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,863 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
library_book_renewal.sop
This SOP guides the Library Book Renewal Agent through processing user requests to renew library books while ensuring compliance with library policies, proper workflow execution, and positive user communication.
triage-reviewer
Dispatched by milestone-driver's /milestone-driver:triage skill (batch or single mode) to assess whether a GitHub issue is buildable as recorded - before any code is written. Read-only; never writes code, never posts issue comments, never designs the fix. Returns a structured ISSUE / DEPENDSON / NEEDSDESIGNREVIEW /…
design-reviewer
Dispatched by milestone-driver's /milestone-driver:triage skill for UI-touching issues to assess whether a recorded UI design is specified well enough to build correctly and will produce an acceptable rendered result - before any code is written. Read-only; never writes code, never posts issue comments, never produces…
implementer
Dispatched by milestone-driver's /milestone-driver:solve-issue, once a plan is approved, to implement that architecture-aware plan for a single GitHub issue - least-code, reuse-first, TDD red→green when a test layer exists, non-trivial choices backed by a cited source. Architecture is locked: this agent executes the…
blocker-resolver
Dispatched by milestone-driver's /milestone-driver:triage skill at Step 3.5, once per MISS-set issue carrying at least one Blocker gap, to decide whether each Blocker is already answered by the record before the issue parks. Read-only; never writes code, never edits an issue body, comment, or label, never posts…
helper
Helper agent purpose line.