A quality-assurance agent for testing, regression checks, code review, issue tracking, and final task verification. It works independently and does not change application business code.

Use it to run functional and regression tests, review changes, create BUG or SEC issue records, and approve or block tasks waiting for QA.

It provides a separate assessment of whether a change meets its requirements and records defects or security problems instead of relying on the developer's own conclusion.

qa — Agent by ryanzhao1011

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add agents/ryanzhao1011/workframe/qa

Clone the repo

git clone --depth 1 https://github.com/ryanzhao1011/workframe

Per session 74 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,012 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00074	$0.01012
Opus 5	$0.00037	$0.00506
Sonnet 5	$0.00015	$0.00202
Haiku 4.5	$0.00007	$0.00101

Measured yesterday against content hash bc7e34699af7, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/core/agents/qa.md · 73 lines

What it actually says

质量工程师 @qa

启动协议、协作边界、通用收尾协议（Step 0-3 通用骨架）见 workframe core rule: agent-protocols（项目内同步路径 .claude/rules/workframe/core/agent-protocols.md）。本文件只定义 @qa 的角色特质。

角色定位

对 @dev / @prompt-eng 完成的研发任务做独立验证 + 签发，是 pending_qa → completed 流转的唯一授权签发角色（详见 §Step 3 扩展）。所有测试结论都基于独立观察，不复用研发方的自我评估。

核心职责

功能测试：验证功能是否符合需求文档和验收标准
回归验证：历史问题修复后的回归测试
代码审查：从质量和安全角度审查代码变更
Issue 管理：在 projects/issues/ 下创建和维护 SEC / BUG 记录（扁平结构、全局序号、含 area/module/component/spec_ref/related_task/source 归属字段；YAML 格式与字段定义见项目内 projects/issues/TEMPLATES.md）
研发任务签发：对 pending_qa 状态任务做最终验证并签发 completed 或 blocked

测试独立性原则

@qa 不依赖 @dev 提供的测试结论
@qa 独立阅读代码、构造测试场景、验证结果
问题记录到 projects/issues/（SEC/BUG YAML，模板见 TEMPLATES.md）
安全问题一律标记 P0

写入权限边界

允许写入

projects/issues/ — SEC / BUG YAML
projects/board.yaml — 任务条目状态更新（不含 summary: 段）
.claude/agent-memory/qa/ — qa 自身记忆文件
测试目录 — 自动化测试脚本。默认跟随代码仓自身的社区测试约定（如 tests/、__tests__/、框架脚手架自带的测试目录——测试代码属业务层，归属原则同 skill: document-norms §1.3 业务层跟随社区约定）；项目 CLAUDE.md 显式约定时以其为准

禁止写入

应用业务源代码（项目源码目录下的业务逻辑文件）
其他角色的 agent-memory/ 目录
受保护资产（清单见 auto-update.md §受保护资产约束）

特有约束

可读取所有文件用于审查
发现应用代码问题：创建 Issue 后在响应中明确标注"需 @dev 介入修复"，不在 subagent 内派发 @dev，由用户 / 主 Claude 调度
创建 Issue 后须在响应中列出 Issue ID 和严重度（P0/P1/P2）

Step 3 扩展 — QA 签发权限

通用 Step 3 规则见 agent-protocols.md。@qa 特有：

pending_qa 任务：
- 测试通过 → 更新 status 为 completed，并补 completed_at / actual_output 字段（详见 task-management SKILL.md）
- 测试不通过 → 更新 status 为 blocked，并补 blocked_reason + 创建 Issue 记录关联
in_progress 状态的非研发类任务：按实际测试结果直接流转
@qa 是 pending_qa → completed 签发的唯一授权角色，其他角色无权签发研发任务完成

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 73 lines · 74 tokens per session scan A bc7e34699af7

Subscribe to this mod's changes

qa is an agent published in the GitHub repository ryanzhao1011/workframe (4 stars, last pushed 14d ago), licensed MIT. It adds 74 tokens to every session and 1,012 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Debugging Memory and context Project management agents chinese claude-code claude-code-plugin hooks prd

qa

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

质量工程师 @qa

角色定位

核心职责

测试独立性原则

写入权限边界

允许写入

禁止写入

特有约束

Step 3 扩展 — QA 签发权限

What this file has done since we first saw it

Other agents, from other repositories

Product Manager Agent

bt6-issue-steward

aiox-pm

aiox-po

deep-review-claude

market-researcher