Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/xiaozhi86/qamasterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/xiaozhi86/qamaster/requirement-review)<a href="https://agentmods.dev/commands/xiaozhi86/qamaster/requirement-review"><img src="https://agentmods.dev/badge/commands/xiaozhi86/qamaster/requirement-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/xiaozhi86/qamaster/requirement-review"><img src="https://agentmods.dev/badge/commands/xiaozhi86/qamaster/requirement-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.01748 |
| Opus 5 | $0.00026 | $0.00874 |
| Sonnet 5 | $0.00011 | $0.00350 |
| Haiku 4.5 | $0.00005 | $0.00175 |
Grade A, and why
requirement-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
启动 qamaster Runtime 受控流程(模型负责思考,Runtime 负责控制——流程状态由 Python 状态机裁决,任何模型不可绕过)。
路径解析(先做·一次)
本命令文件位于 plugin 根目录的 commands/ 下,Runtime 位于同级 ../runtime/。候选列表存在性探测(同 case-design,适配 marketplace 缓存安装):
# 有序候选:逐一 [ -f ] 探测,取第一个命中
PLUGIN_ROOT=""
for c in \
"$(cd "$(dirname "$0")/.." 2>/dev/null && pwd)" \
"$HOME/.claude/plugins/qamaster" \
$(ls -d "$HOME"/.claude/plugins/cache/qamaster/qamaster/*/ 2>/dev/null | sort -V | tail -1) \
"D:/qamaster" \
; do
[ -n "$c" ] && [ -f "${c%/}/runtime/qamaster_runtime.py" ] && PLUGIN_ROOT="${c%/}" && break
done
echo "PLUGIN_ROOT=$PLUGIN_ROOT"
- 候选 4 为本地开发仓库路径,按实际克隆位置调整;候选 3 为 marketplace 缓存安装(glob 取版本号最大者)。
- 全部候选未命中 → 判定"Runtime 未安装":允许进入薄客户端降级(SKILL.md 7-Agent 流程定义执行,阶段顺序与门禁由模型自律)。
- 候选命中但执行报错 → 判定"Runtime 存在但调用失败":禁止降级,退避重试至多 3 次;仍失败则暂停流程、不得落盘
ReviewedReq_*.md。
第一步:启动 Runtime(bootstrap → start,必须先做·单步不变对用户透明)
cd "<用户当前项目根>"
# 1) bootstrap 派生 req_id(不创建状态·幂等可重跑);检测到在途状态输出 RESUME
REQ_ID=$(python "$PLUGIN_ROOT/runtime/qamaster_runtime.py" bootstrap \
--workflow requirement-review --user-input "$ARGUMENTS" --workdir "$(pwd)" \
| sed -n 's/.*req_id=\([^ ]*\).*/\1/p' | head -1)
# 2) start 按 (workflow, req_id) 创建/续跑状态(状态落 .qamaster/requirement-review/<req_id>/)
python "$PLUGIN_ROOT/runtime/qamaster_runtime.py" start \
--workflow requirement-review --req-id "$REQ_ID" --workdir "$(pwd)"
- cwd 必须是用户项目根(产出物写
./requirement-review-out/,状态写./.qamaster/requirement-review/<req_id>/)。 req_id由 bootstrap 派生(文件取首个#标题清洗 / 内联取首个非空行;去重,碰撞加-YYYYMMDD),模型不在阶段内派生 id。bootstrap 若失败(空 id 等),停下报错指引,不得跳过。- 输出含【RUNTIME CONTRACT 契约卡】:先按其提示一次性阅读业务规范
skills/requirement-review/SKILL.md(专家团评审细则/输入协议)+ 评审基线契约skills/requirement-review/references/baseline.md,随后回到契约卡执行当前 Phase。 - 已存在进行中的同一 req 时,bootstrap 输出
RESUME→start走 resume 分支断点续跑(恢复契约卡,不重置)。
第二步:按契约卡执行当前 Phase
每阶段只做契约卡 ALLOWED 中的事,产物达标后:
python "$PLUGIN_ROOT/runtime/qamaster_runtime.py" gate --workflow requirement-review --req-id "$REQ_ID" # 出口门禁(机器判定,禁止自证)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines · +5 tokens per session d5f13b44e0a3
- 8d ago First seen · 83 lines · 48 tokens per session scan A 1ed244d89509
requirement-review is a command published in the GitHub repository xiaozhi86/qamaster (5 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 1,748 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
awesome-chatgpt
Search awesome-ChatGPT-repositories for open-source GitHub repositories related to ChatGPT and LLMs.
agentlas-local
Staff a task only from Agentlas agents registered on this machine.
commit
A command that examines staged Git changes and proposes a commit message using the Conventional Commits format, such as feat, fix, or docs. Git is a tool for tracking changes to code.
speckit.archive
Archive a feature specification into main project memory after merge, resolving gaps and conflicts.
speckit.opsmill.retrospect
Run a session retrospective that surfaces context-management gaps and routes them to approved follow-up actions.
pr
Handle the full workflow from current branch state to an open, CI-monitored pull request.