Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/florian101010/awesome-agentic-ai-coding-template/qa-auditgit clone --depth 1 https://github.com/florian101010/awesome-agentic-AI-coding-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/florian101010/awesome-agentic-ai-coding-template/qa-audit)<a href="https://agentmods.dev/instructions/florian101010/awesome-agentic-ai-coding-template/qa-audit"><img src="https://agentmods.dev/badge/instructions/florian101010/awesome-agentic-ai-coding-template/qa-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00589 | $0.00589 |
| Opus 5 | $0.00295 | $0.00295 |
| Sonnet 5 | $0.00118 | $0.00118 |
| Haiku 4.5 | $0.00059 | $0.00059 |
Grade A, and why
QA Audit Process scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA-Audit Instructions
When to Use
Apply this when performing a quality audit, security review, or robustness check of [FILL: main-source-file].
Audit Scope Options
- Source-only — Main source file (HTML + CSS + JS, or equivalent)
- Config-included — Source + all config files
- Full Scope Paranoid — Source + Config + Agent Rules + Docs (recommended)
9-Phase Process
- Baseline — Run
npm testand any config/asset verification scripts - Source Full Read — Read every section of the main source file
- Rule Compliance — Verify code against ALL rule files (AGENTS.md, CLAUDE.md, copilot-instructions.md,
.claude/rules/,.agent/rules/) - Config Verification — Schema conformity and cross-references between configs
- Security Scan — All innerHTML + escaping, forbidden APIs, injection risks
- Edge-Case & Robustness — Race conditions, error propagation, compatibility guards
- Documentation Drift — Code IST vs. documented SOLL values across all rule files
- Classification & Report — Severity: CRITICAL (security), HIGH (functional), MEDIUM (rules/robustness), LOW (hygiene)
- Fix Planning — Risk per finding, fix order, verification method
Key Security Checks
- Every
innerHTMLwith config-/runtime-derived text MUST use a safe escaping function - No
eval(),Function(),document.write(),postMessage,localStorage - [FILL: Project-specific security check 1]
Key Rule Compliance Checks
- [FILL: Project-specific rule 1] — e.g. "touch-action: manipulation on every interactive element"
- [FILL: Project-specific rule 2] — e.g. "All assets rendered via a safe helper function with fallback"
- Relative paths only — no leading
/or./(if applicable)
Report Format
Save to docs/QA-AUDIT-{YYYY-MM-DD}.md with severity-classified findings including exact file/line references, violated rule, code snippet, impact, and fix suggestion.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 53 lines · 589 tokens per session scan A 51b9e3a5f694
QA Audit Process is an instructions file published in the GitHub repository florian101010/awesome-agentic-AI-coding-template (4 stars, last pushed 6mo ago), licensed MIT. It adds 589 tokens to every session, about $0.0029 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
ai-driven-development AGENTS.md
AGENTS.md instructions for CodeAlive-AI/ai-driven-development, covering ai-driven development — development guide, git publishing defaults, when to create tags and releases, requires a new tag/release and does not require a new tag/release.
cc-use-exp frontend.instructions.md
Instructions for doccker/cc-use-exp, a project described as: ⛔ No longer maintained → dev-agent-kit/recipes 让 Claude Code、Antigravity、Gemini CLI、Codex、Cursor 开箱即用的分层配置模板，总结十多年的日常开发经验.
capy CLAUDE.md
Claude Code instructions for serpro69/capy, covering claude.md, project, architecture, key packages and critical invariants.
Skillry AGENTS.md
AGENTS.md instructions for FluxonLab/Skillry, covering agents.md, operating model, core engineering principles, evidence, research, and verification and scope, plans, and decisions.
ai-driven-development CLAUDE.md
Claude Code instructions for CodeAlive-AI/ai-driven-development, a project described as: Practices, protocols, and skills for AI-driven software development. Skills and safety hooks for Claude Code, Codex, OpenCode, Cursor, Antigravity, and any agent supporting the Agent Skills standard.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).