A set of QA rules for checking completed software work before marking it done. It matches the checks to the type of change, such as a bug fix, feature, documentation change, or security fix.

Use it to choose verification steps, run relevant builds and tests, check edge cases, and review code for unsafe inputs, secrets, dead code, and naming or layering issues.

It reduces the risk of closing work that is untested, incomplete, or affected by common code-quality problems.

qa-review — Cursor rule for coding agents by Hundia: A set of QA rules for checking completed software…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/hundia/autospec/qa-review

Clone the repo

git clone --depth 1 https://github.com/Hundia/autospec

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/hundia/autospec/qa-review.svg)](https://agentmods.dev/rules/hundia/autospec/qa-review)

Your own site

<a href="https://agentmods.dev/rules/hundia/autospec/qa-review"><img src="https://agentmods.dev/badge/rules/hundia/autospec/qa-review.svg" alt="Measured on agentmods" height="20"></a>

Per session 0 Nothing until a file matches its globs; then the whole rule loads.

When invoked 694 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin unknown No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.00694
Opus 5	$0.00000	$0.00347
Sonnet 5	$0.00000	$0.00139
Haiku 4.5	$0.00000	$0.00069

Measured today against content hash 903d9dca9362, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

examples/ai-support-ops/skills/cursor/rules/qa-review.mdc · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Review Protocol

Verify completed work before marking tickets as ✅ Done.

Scale QA to Change Type

Change Type	Verification Level
Docs/config only	Review accuracy — no build required
Bug fix	Reproduce → verify fix → run related tests
CLI change	`npm run build` + `npm test` in `cli/`
Viewer change	`npm run build` in `viewer/` + visual check
New feature	Full test suite + new test cases + integration check
Refactor	Full test suite — all existing tests must pass
Security fix	Full test suite + manual verification of the vulnerability

Code Quality Checklist

TypeScript strict mode — no any types without justification
Zod schemas for all external input validation
No hardcoded secrets, API keys, or credentials
Error handling covers edge cases (null, undefined, empty arrays)
No unused imports or dead code
Follows repository → service → controller layering
Component naming matches file naming conventions

Testing Checklist

Existing tests still pass
New tests written for new functionality
Edge cases covered (empty input, large input, invalid input)
Test descriptions are clear and descriptive
No skipped tests without a tracking ticket

Functionality Checklist

Feature matches the ticket description and acceptance criteria
UI changes are visually correct (if applicable)
No regressions in related features
Error messages are user-friendly
Loading and empty states handled

Security Checklist

User input is validated before processing
No SQL injection or XSS vectors
API endpoints check authorization
Sensitive data is not logged or exposed
Dependencies are up to date (no known vulnerabilities)

Documentation Checklist

Relevant docs/ files updated
Code comments explain non-obvious logic
README or QUICKSTART updated if user-facing behavior changed
API changes reflected in specs/06-api-surface.md

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today First seen · 93 lines · 0 tokens per session scan A 903d9dca9362

Subscribe to this mod's changes

qa-review is a cursor rule published in the GitHub repository Hundia/autospec (4 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 694 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Code review TDD Testing

qa-review