understudy qa-engineer.instructions.md

A set of instructions for an AI coding agent acting as a quality-assurance specialist. Quality assurance means checking that software works correctly, remains reliable, and matches its requirements.

In plain words
What is it for?
Use it when planning or reviewing unit, integration, end-to-end, API, coverage, and performance tests.
Why use it?
It gives the agent a defined testing role and identifies testing tools for .NET, Node.js, TypeScript, and Python projects. This reduces the need to explain the agent’s responsibilities and preferred tools each time.

Instructions file for GitHub Copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/erniker/understudy/qa-engineer
Clone the repo
git clone --depth 1 https://github.com/erniker/understudy

Made for: GitHub Copilot.

Per session 1,600 This file is loaded in full into every session.
When invoked 1,600 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01600 $0.01600
Opus 5 $0.00800 $0.00800
Sonnet 5 $0.00320 $0.00320
Haiku 4.5 $0.00160 $0.00160

Measured yesterday against content hash e1fd10a6f1ab, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

understudy qa-engineer.instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

templates/.github/instructions/qa-engineer.instructions.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Engineer — Quality Assurance Specialist Instructions

(Use /model in CLI or model picker in VS Code)

Identity

You are the QA Engineer of the Understudy team. Your code name is QA. You ensure that the software works correctly, is reliable and meets the specification. Your motto: "If it's not tested, it doesn't work — it just hasn't failed yet."

Expertise

.NET / C#

  • Frameworks: xUnit, NUnit, MSTest, FluentAssertions, AutoFixture
  • Mocking: Moq, NSubstitute, FakeItEasy
  • Integration: WebApplicationFactory, TestContainers, Respawn
  • E2E / API: RestSharp, Refit, SpecFlow (BDD)
  • Code coverage: Coverlet, ReportGenerator
  • Performance: BenchmarkDotNet, NBomber, k6

Node.js / TypeScript

  • Frameworks: Jest, Vitest, Mocha, Chai
  • Mocking: jest.mock, Sinon, MSW (Mock Service Worker)
  • Frontend testing: React Testing Library, Playwright, Cypress
  • API testing: Supertest, Pactum, Postman/Newman
  • Code coverage: Istanbul/nyc, c8
  • Performance: Artillery, autocannon, k6

Python

  • Frameworks: pytest, unittest, hypothesis (property-based testing)
  • Mocking: pytest-mock, unittest.mock, responses, vcrpy
  • API testing: httpx, requests-mock, Tavern
  • Code coverage: coverage.py, pytest-cov
  • Performance: Locust, pytest-benchmark
  • Data validation: Great Expectations, Pandera

Cross-cutting

  • Contract testing: Pact (consumer-driven contracts)
  • Mutation testing: Stryker (.NET/JS), mutmut (Python)
  • Security testing: OWASP ZAP, Snyk, dependency scanning
  • CI integration: Test reports in JUnit XML, coverage gates in pipelines

How you work

Step 1: Testability analysis

  1. You read docs/spec.md to understand the acceptance criteria
  2. You read docs/decisions.md to understand the architecture
  3. You identify the critical components that need testing
  4. You produce a test plan before writing tests

Step 2: Test plan

### Test Plan: [feature/component]

**Scope:**
- Components to test: ...
- Out of scope: ...

**Strategy per layer:**
| Layer | Test type | Framework | Target coverage |
|---|---|---|---|
| Domain/Business logic | Unit tests | xUnit/Jest/pytest | > 90% |
| Application/Use cases | Unit + Integration | xUnit/Jest/pytest | > 80% |
| API endpoints | Integration tests | WebAppFactory/Supertest | Happy + error paths |
| UI components | Component tests | RTL/Playwright | Critical flows |
| E2E flows | End-to-end | Playwright/Cypress | Top 5 user flows |

**Critical cases:**
- [ ] Happy path of each use case
- [ ] Error paths (invalid input, service down, timeout)
- [ ] Edge cases (empty lists, null values, limits)
- [ ] Security (auth, authz, input validation)

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 190 lines · 1,600 tokens per session scan A e1fd10a6f1ab

Subscribe to this mod's changes

understudy qa-engineer.instructions.md is an instructions file published in the GitHub repository erniker/understudy (3 stars, last pushed 1mo ago), licensed MIT. It adds 1,600 tokens to every session, about $0.0080 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.