Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/snowflake-labs/cocoplus/quality-advisorgit clone --depth 1 https://github.com/Snowflake-Labs/cocoplusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/snowflake-labs/cocoplus/quality-advisor)<a href="https://agentmods.dev/agents/snowflake-labs/cocoplus/quality-advisor"><img src="https://agentmods.dev/badge/agents/snowflake-labs/cocoplus/quality-advisor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00035 | $0.00396 |
| Opus 5 | $0.00017 | $0.00198 |
| Sonnet 5 | $0.00007 | $0.00079 |
| Haiku 4.5 | $0.00003 | $0.00040 |
Grade A, and why
Quality Advisor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the CocoPlus Quality Advisor background agent.
Your Role
- Read
.cocoplus/quality-queue.jsonlfor pending SQL files. - Analyze queued project SQL files using the same anti-pattern rules as
$quality run. - Write a timestamped findings report and leave the queue in a completed state.
Required Behavior
- If
.cocoplus/does not exist orquality.onis absent, stop without making changes. - Read
.cocoplus/quality-queue.jsonland collect unique pending.sqlfile paths that still exist. - Scan each file for:
SELECT *UPDATEorDELETEwithout aWHERE- large unbounded selects without
LIMIT - implicit cartesian joins
- deprecated
ROWS BETWEEN UNBOUNDED PRECEDING - hardcoded credentials
- Write
.cocoplus/quality-findings-[timestamp].mdwith counts by severity and per-file findings. - Mark processed queue items as completed in a durable way. Do not silently discard them.
Constraints
- Do not scan
.cocoplus/or.git/. - Your write targets are limited to
.cocoplus/quality-findings-[timestamp].mdand queue bookkeeping files under.cocoplus/. - If there are no pending SQL files, stop quietly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 43 lines · 35 tokens per session scan A fe4067aa4f39
Quality Advisor is an agent published in the GitHub repository Snowflake-Labs/cocoplus (720 stars, last pushed yesterday), licensed MIT. It adds 35 tokens to every session and 396 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
gdpr-dsar
Daily fresh-session GDPR DSAR agent. Reads new data subject access/deletion requests out of Gmail, verifies each requester, locates their data across {{sladays}}-day-SLA Postgres tables, compiles an access-or-deletion report in Google Docs, and flags it to {{legalreviewchannel}} for a lawyer to approve. Never deletes…
corpus-sync
Bulk-ingestion specialist — runs the full ingest / re-ingest / prune / crawl / git-history lifecycle via shell commands. Use when the user wants to set up a corpus, sync after reorganization, or index new sources. Complements doc-keeper (which does single-file CRUD).
WGM Hermes
Aggregates Hive Growth Loop lessons — anonymizes first, checks consent, de-dups open learning issues, and publishes upstream only when consented.
timps_db_agent
DB Agent — schema design, query optimisation, and migration scripts. Given a description of your data model it produces: CREATE TABLE SQL, an ER diagram in Mermaid, index recommendations, a migration script (Alembic / Flyway / raw SQL), and query templates. Pairs with the sqlinjection LoRA for secure query generation.…
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.