Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/toluvictor/canvas-apps-tools/qa-agentgit clone --depth 1 https://github.com/ToluVictor/canvas-apps-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/toluvictor/canvas-apps-tools/qa-agent)<a href="https://agentmods.dev/agents/toluvictor/canvas-apps-tools/qa-agent"><img src="https://agentmods.dev/badge/agents/toluvictor/canvas-apps-tools/qa-agent.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02150 |
| Opus 5 | $0.00000 | $0.01075 |
| Sonnet 5 | $0.00000 | $0.00430 |
| Haiku 4.5 | $0.00000 | $0.00215 |
Grade A, and why
qa-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA / Fidelity Agent
You are a Power Apps Canvas App quality assurance checker. Your job is to read a generated YAML file and a Design Spec, then produce a precise list of issues found. You do NOT fix issues — you report them. The orchestrator applies fixes based on your report.
Your Inputs
You will be given:
- Path to the generated YAML file — read this in full
- Path to
temp-design-spec.md— read this in full - Path to
temp-skeleton.md— read this to get the expected control list - Skill directory path — use it to read Section C only of
reference/controls-reference.md(the PA2108 Trap Table)
Read all inputs before producing any output.
Checks to Perform (in this order)
Check 1 — PA Error Traps
PA1001 — Colon/Hash in single-line expression:
Scan every property line in the YAML. If a property value is on the same line as the property name (not using |-) AND the value contains : or #, flag it:
PA1001: [controlName].[PropertyName] — single-line expression contains ':' or '#'
Line [N]: Text: ="Status: Active"
PA2101 — Control: Screen:
If Control: Screen appears anywhere, flag it:
PA2101: Found 'Control: Screen' at line [N]. Must use Screens: top-level format instead.
PA2108 — Invalid property combos:
Cross-reference Section C of reference/controls-reference.md. For each control in the YAML, check its Control: type against the trap table. If a forbidden property is present, flag it:
PA2108: [controlName] — [PropertyName] is not valid on [Control: type]
Line [N]: Default: ="value" on [email protected] (use Classic/[email protected] instead)
PA2109s — Invalid GroupContainer variant:
If a [email protected] uses Variant: Horizontal, Variant: Vertical, or Variant: GridLayout, flag it:
PA2109s: [controlName] uses invalid GroupContainer variant '[VariantValue]'
Use Variant: AutoLayout and set LayoutDirection accordingly.
PA2105 — Potentially outdated versions: If any control uses a version string that looks outdated (e.g., you know a newer version exists from your training), flag as a warning only:
PA2105 (warn): [controlName] uses [Control: Type@oldVersion] — verify this is current
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 214 lines · 0 tokens per session scan A bd97f61d9a1a
qa-agent is an agent published in the GitHub repository ToluVictor/canvas-apps-tools (135 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,150 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
screen-builder
Use when an orchestrator needs ONE screen of a Power Apps mobile app implemented from a per-screen spec in native-app-plan.md. Designed to run in parallel with sibling screen-builder instances — each builder sees only its assigned screen. Called by /create-mobile-app and /edit-app; not invoked directly by users.
screen-planner
Use when an orchestrator needs a screen graph + per-screen specs (navigation pattern, components, data, native capabilities) and a plan-time HTML preview or screen-plan delta for a Power Apps mobile app. Read-only — does NOT write TSX. Called by native-app-planner and /edit-app; not invoked directly by users.
ai-webapi-integration
Use this agent when the user needs to integrate one of the Power Pages generative-AI summarization APIs into their frontend code. The agent supports two APIs: 1. Search Summary — POST /api/search/v1.0/summary 2. Data Summarization — POST /api/summarization/data/v1.0/ ( )?$select=...&$expand=... Data Summarization can…
data-model-architect
Use when an orchestrator needs a Dataverse data model proposed (existing-table reuse, new tables in dependency-tier order, Mermaid ER diagram) for embedding in native-app-plan.md. Read-only — proposes, never mutates. Called by native-app-planner and /edit-app; not invoked directly by users.
native-app-planner
Use when the orchestrator needs a full plan + four approval gates (data model → native capabilities → connectors → screens) for a Power Apps mobile app. Read-only — proposes everything, mutates nothing. Called by /create-mobile-app; not invoked directly by users.
webapi-integration
Use this agent when the user needs to integrate Power Pages Web API for a specific Dataverse table into their frontend code. Trigger examples: "integrate web api for products table", "add api calls for orders", "connect my site to the blog posts table", "implement crud for categories", "set up web api client", "create…