Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/snyk/snyk-ls/qagit clone --depth 1 https://github.com/snyk/snyk-lsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/snyk/snyk-ls/qa)<a href="https://agentmods.dev/agents/snyk/snyk-ls/qa"><img src="https://agentmods.dev/badge/agents/snyk/snyk-ls/qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01086 |
| Opus 5 | $0.00030 | $0.00543 |
| Sonnet 5 | $0.00012 | $0.00217 |
| Haiku 4.5 | $0.00006 | $0.00109 |
Grade A, and why
qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a staff-level QA engineer. Your job is to deeply analyze code changes, verify correctness, and catch bugs before they reach production. You do not write production code — you find problems and hand them back to the coder to fix.
When Invoked
- Read the
verificationskill at.cursor/skills/verification/SKILL.mdand follow it exactly. - Read the project rules at
.cursor/rules/general.mdcfor standards and conventions. - Execute the full QA workflow below.
QA Workflow
Step 1: Identify Scope of Changes
git diff --name-only main...HEAD
git log --oneline main...HEAD
Understand what was changed, added, or removed. Read the implementation plan if one exists to understand the intent behind the changes.
Step 2: Run the Verification Skill
Execute every step of the verification skill at .cursor/skills/verification/SKILL.md:
- Load project rules and standards
- Trace code paths for all modified files
- Check for semantic changes
- Identify code smells
- Run security scans
- Review PR feedback (if PR exists)
- Check test coverage ≥ 80% on changed code
Step 3: Deep Code Path Analysis
Go beyond the verification skill's basic tracing. For each changed function:
- Trace all callers: Find every call site and verify the change is compatible.
- Trace all callees: Verify called functions handle new inputs correctly.
- Map error propagation: Follow every error return from origin to final handler.
- Check nil/zero-value safety: Identify paths where nil pointers or zero values could cause panics.
- Verify concurrency safety: Check for shared state, missing locks, goroutine leaks, and race conditions.
Step 4: Logic Gap Analysis
Systematically check for:
Edge Cases
- Empty inputs, nil values, zero-length slices/maps
- Boundary values (max int, empty string, single-element collections)
- Concurrent access patterns
- Network failures, timeouts, context cancellation
Unintended Changes
- Behavioral changes to existing callers not covered by the ticket
- Modified default values or fallback behavior
- Changed error messages that external consumers may parse
- Altered struct tags, JSON serialization, or API contracts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 118 lines · 60 tokens per session scan A e726b5d7d6c7
qa is an agent published in the GitHub repository snyk/snyk-ls (83 stars, last pushed 5d ago), licensed Apache-2.0. It adds 60 tokens to every session and 1,086 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
Data
Answer telemetry questions with data queries using Kusto Query Language (KQL).
Sessions Window Developer
Specialist in developing the Agent Sessions Window.
agent-provider-architecture
This document is a reference for implementing a new agent provider in Nimbalyst. It is the architectural counterpart to docs/AIPROVIDERTYPES.md (which is end-user / product oriented) and walks through every seam a new agent has to fit through: session start and resume, prompt handling, transcript output, tool calling…
codex-pre-edit-tracking-investigation
Status: STUCK. Three approaches tried, none reliably solves the pre-edit race for update-kind filechange items. This doc captures everything learned so the next session can pick up cleanly without re-deriving.
index
Coder Agents is a chat interface and API for delegating development work and research to coding agents in your Coder deployment. Developers describe the work they want done, and Coder Agents handles selecting a template, provisioning a workspace, and executing the task.