ui-aqa-flow-code-analysis

ui-aqa-flow-code-analysis is a command for coding agents from griddynamics/rosetta. It costs 17 tokens per session (1,709 once invoked), scanned A, original, Apache-2.0.

Phase 3 Code Analysis of ui-aqa-flow.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/griddynamics/rosetta/ui-aqa-flow-code-analysis
Clone the repo
git clone --depth 1 https://github.com/griddynamics/rosetta

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ui-aqa-flow-code-analysis

README.md
[![agentmods](https://agentmods.dev/badge/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis.svg)](https://agentmods.dev/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis)
Your own site
<a href="https://agentmods.dev/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis"><img src="https://agentmods.dev/badge/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis.svg" alt="Measured on agentmods" height="20"></a>
Per session 17 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,709 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00017 $0.01709
Opus 5 $0.00009 $0.00855
Sonnet 5 $0.00003 $0.00342
Haiku 4.5 $0.00002 $0.00171

Measured today against content hash 51b6309384f8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ui-aqa-flow-code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/core-copilot-light/commands/ui-aqa-flow-code-analysis.md · 97 lines

How it starts

The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.

<ui_aqa_flow_code_analysis>

<description_and_purpose> Understand existing test architecture, identify reusable components, and determine where new test should be integrated. </description_and_purpose>

<workflow_context>

  • Phase 3 of 8 in ui-aqa-flow
  • Input: test plan with assertions and clarifications
  • Output artifact path (single SSoT — referenced by other sections): plans/ui-aqa-<test-name>/code-analysis.md (resolve <test-name> per qa-structure's UI layout slug rules)
  • Prerequisite: Phases 1 and 2 complete
  • Read-only scope (single SSoT — referenced by other sections as "the read-only scope"): read project description, configured project context, page objects, similar tests, utilities; produce the report + a one-paragraph ## Code Analysis summary in the test plan. NO edits to page objects, test files, source under analysis, project_description.md, gain.json, or repo docs; NO running tests/lint/build. A finding that implies code work is surfaced in the report, not acted on.
  • Required skills: qa-knowledge (code_analysis mode), reverse-engineering (test-automation architecture analysis), sensitive-data (redaction), qa-structure (slug + report path) </workflow_context>

<input_contract> The phase supplies these paths to the skill; defaults apply when not configured:

Input Default path Required content
Test plan plans/ui-aqa-<test-name>/test-plan.md Test name + clarified assertions
Project setup repository-root gain.json SDLC configuration + any file-location overrides
Project description project_description.md (repo root) Framework, language, structure, coding standards — read when present
Project context configured paths; canonical docs/CONTEXT.md, docs/ARCHITECTURE.md, agents/IMPLEMENTATION.md Architecture and conventions — read when present
Optional user instructions agents/user-instructions/ Test guidelines, custom matchers, style
Optional frontend source repo-specific (e.g. refsrc/<repo>/) Component files for selector / test-id discovery
Output plans/ui-aqa-<test-name>/code-analysis.md The report (this phase's contract, below)

Input GATE. Before analysis: test plan exists and is non-empty; project_description.md, gain.json, or one authoritative project-context file exists; codebase root is readable. Resolve file locations from gain.json, falling back to the canonical paths above. Any miss → stop Phase 3, record the gap in ui-aqa-state.md, ask the user. Do NOT infer framework from incidental file extensions.

Path/content precedence. gain.json wins for file locations. For engineering conventions, authoritative repo docs win over project_description.md, user-instruction files, and examples; record conflicts in ## Conflicts and Precedence. </input_contract>

<code_analysis_report_contract> plans/ui-aqa-<test-name>/code-analysis.md is tracked + downstream-fed — PUBLIC by default. USE SKILL sensitive-data: scan the rendered artifact BEFORE writing, fail-closed (no scan → no emit). The report's 9-section structure and the test-location decision rule are qa-knowledge's code-analysis report template — every section present (empty optional section says not available — see Coverage section).

After writing the report, update the test plan's ## Code Analysis section with a one-paragraph summary linking to it — do NOT duplicate report contents into the plan. </code_analysis_report_contract>

<phase_steps>

  1. Execute codebase analysis (reads project description + resolved project context, page objects, similar tests)
  2. Validate findings
  3. Update state </phase_steps>

<execute_analysis step="3.1" subagent="discoverer" role="Test architecture analyst">

  1. USE SKILL qa-structure to resolve run paths. Run the <input_contract> Input GATE.
  2. USE SKILL reverse-engineering and USE SKILL qa-knowledge (code_analysis mode — test-automation architecture analysis) with the phase-supplied bindings: inputs + defaults = <input_contract>; report structure + test-location rule = the skill's code-analysis report template; output path = plans/ui-aqa-<test-name>/code-analysis.md. USE SKILL sensitive-data before writing.
  3. Conditional-input else-paths:
    • If agents/user-instructions/ is absent or empty: record not available — see Coverage section in report section 2 and not available in section 9; Phase 3 continues, does not stop.
    • If a frontend source path is not discoverable (no gain.json/configured source reference, no refsrc/<repo>/): skip frontend analysis, record the gap in section 9 per the coverage epistemic-honesty rule; Phase 3 continues.
  4. Do not fabricate framework, page objects, or pass/fail data. Honor the read-only scope (<workflow_context>).
  5. Post-analysis verification: confirm the report exists with every section from the code-analysis report template and the test plan's ## Code Analysis summary is added. If missing/incomplete: re-run once with the same bindings; if still failing, stop Phase 3, record Phase 3 blocked: code-analysis report not produced/incomplete in agents/TEMP/<FEATURE>/ui-aqa-state.md, ask the user. </execute_analysis>

Read the full file on GitHub · 97 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 97 lines · 17 tokens per session scan A 51b6309384f8

Subscribe to this mod's changes

ui-aqa-flow-code-analysis is a command published in the GitHub repository griddynamics/rosetta (342 stars, last pushed today), licensed Apache-2.0. It adds 17 tokens to every session and 1,709 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.