Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/griddynamics/rosetta/ui-aqa-flow-code-analysisgit clone --depth 1 https://github.com/griddynamics/rosettaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis)<a href="https://agentmods.dev/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis"><img src="https://agentmods.dev/badge/commands/griddynamics/rosetta/ui-aqa-flow-code-analysis.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.01709 |
| Opus 5 | $0.00009 | $0.00855 |
| Sonnet 5 | $0.00003 | $0.00342 |
| Haiku 4.5 | $0.00002 | $0.00171 |
Grade A, and why
ui-aqa-flow-code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<ui_aqa_flow_code_analysis>
<description_and_purpose> Understand existing test architecture, identify reusable components, and determine where new test should be integrated. </description_and_purpose>
<workflow_context>
- Phase 3 of 8 in
ui-aqa-flow - Input: test plan with assertions and clarifications
- Output artifact path (single SSoT — referenced by other sections):
plans/ui-aqa-<test-name>/code-analysis.md(resolve<test-name>perqa-structure's UI layout slug rules) - Prerequisite: Phases 1 and 2 complete
- Read-only scope (single SSoT — referenced by other sections as "the read-only scope"): read project description, configured project context, page objects, similar tests, utilities; produce the report + a one-paragraph
## Code Analysissummary in the test plan. NO edits to page objects, test files, source under analysis,project_description.md,gain.json, or repo docs; NO running tests/lint/build. A finding that implies code work is surfaced in the report, not acted on. - Required skills:
qa-knowledge(code_analysismode),reverse-engineering(test-automation architecture analysis),sensitive-data(redaction),qa-structure(slug + report path) </workflow_context>
<input_contract> The phase supplies these paths to the skill; defaults apply when not configured:
| Input | Default path | Required content |
|---|---|---|
| Test plan | plans/ui-aqa-<test-name>/test-plan.md |
Test name + clarified assertions |
| Project setup | repository-root gain.json |
SDLC configuration + any file-location overrides |
| Project description | project_description.md (repo root) |
Framework, language, structure, coding standards — read when present |
| Project context | configured paths; canonical docs/CONTEXT.md, docs/ARCHITECTURE.md, agents/IMPLEMENTATION.md |
Architecture and conventions — read when present |
| Optional user instructions | agents/user-instructions/ |
Test guidelines, custom matchers, style |
| Optional frontend source | repo-specific (e.g. refsrc/<repo>/) |
Component files for selector / test-id discovery |
| Output | plans/ui-aqa-<test-name>/code-analysis.md |
The report (this phase's contract, below) |
Input GATE. Before analysis: test plan exists and is non-empty; project_description.md, gain.json, or one authoritative project-context file exists; codebase root is readable. Resolve file locations from gain.json, falling back to the canonical paths above. Any miss → stop Phase 3, record the gap in ui-aqa-state.md, ask the user. Do NOT infer framework from incidental file extensions.
Path/content precedence. gain.json wins for file locations. For engineering conventions, authoritative repo docs win over project_description.md, user-instruction files, and examples; record conflicts in ## Conflicts and Precedence.
</input_contract>
<code_analysis_report_contract>
plans/ui-aqa-<test-name>/code-analysis.md is tracked + downstream-fed — PUBLIC by default. USE SKILL sensitive-data: scan the rendered artifact BEFORE writing, fail-closed (no scan → no emit). The report's 9-section structure and the test-location decision rule are qa-knowledge's code-analysis report template — every section present (empty optional section says not available — see Coverage section).
After writing the report, update the test plan's ## Code Analysis section with a one-paragraph summary linking to it — do NOT duplicate report contents into the plan.
</code_analysis_report_contract>
<phase_steps>
- Execute codebase analysis (reads project description + resolved project context, page objects, similar tests)
- Validate findings
- Update state </phase_steps>
<execute_analysis step="3.1" subagent="discoverer" role="Test architecture analyst">
- USE SKILL
qa-structureto resolve run paths. Run the<input_contract>Input GATE. - USE SKILL
reverse-engineeringand USE SKILLqa-knowledge(code_analysismode — test-automation architecture analysis) with the phase-supplied bindings: inputs + defaults =<input_contract>; report structure + test-location rule = the skill's code-analysis report template; output path =plans/ui-aqa-<test-name>/code-analysis.md. USE SKILLsensitive-databefore writing. - Conditional-input else-paths:
- If
agents/user-instructions/is absent or empty: recordnot available — see Coverage sectionin report section 2 andnot availablein section 9; Phase 3 continues, does not stop. - If a frontend source path is not discoverable (no
gain.json/configured source reference, norefsrc/<repo>/): skip frontend analysis, record the gap in section 9 per the coverage epistemic-honesty rule; Phase 3 continues.
- If
- Do not fabricate framework, page objects, or pass/fail data. Honor the read-only scope (
<workflow_context>). - Post-analysis verification: confirm the report exists with every section from the code-analysis report template and the test plan's
## Code Analysissummary is added. If missing/incomplete: re-run once with the same bindings; if still failing, stop Phase 3, recordPhase 3 blocked: code-analysis report not produced/incompleteinagents/TEMP/<FEATURE>/ui-aqa-state.md, ask the user. </execute_analysis>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 97 lines · 17 tokens per session scan A 51b6309384f8
ui-aqa-flow-code-analysis is a command published in the GitHub repository griddynamics/rosetta (342 stars, last pushed today), licensed Apache-2.0. It adds 17 tokens to every session and 1,709 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
resolve-conflicts
Resolve merge conflicts on a GitHub PR by merging the base branch into the PR branch in an isolated git worktree, with JSON/markdown-aware conflict resolution.
xpoz-best-practices
Reference docs for Xpoz query syntax, pagination, field selection, platform tools, and authentication. Usage: /xpoz-best-practices.
align
Verify spec-vs-spec alignment and brevity across the intent tree. This is NOT QA — QA checks code against a spec; alignment checks whether specs are consistent with their ancestors and internally tight against the Brevity Contract. The aligner runs three passes per walk.
deploy-check
Pre-flight verification before pushing to main. Reproduces the CI gates locally so the push doesn't fail in production.
validate-fix
Validate a proposed React fix with React-Sentinel assertions or replay checks.
rclone_mkdir
Make the path if it doesn't already exist.