Borrowing it
Nothing to install: this file belongs to alfredoperez/speckit-companion. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/alfredoperez/speckit-companion/main/.claude/skills/release-qa/SKILL.mdgit clone --depth 1 https://github.com/alfredoperez/speckit-companionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alfredoperez/speckit-companion/release-qa)<a href="https://agentmods.dev/skills/alfredoperez/speckit-companion/release-qa"><img src="https://agentmods.dev/badge/skills/alfredoperez/speckit-companion/release-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alfredoperez/speckit-companion/release-qa"><img src="https://agentmods.dev/badge/skills/alfredoperez/speckit-companion/release-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00174 | $0.07634 |
| Opus 5.5 | $0.00070 | $0.03054 |
| Sonnet 5.5 | $0.00035 | $0.01527 |
| Haiku 4.5 | $0.00017 | $0.00763 |
Grade C, and why
release-qa scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- [ ] Keep `$SANDBOX` until the report's findings are triaged, then `rm -rf "$SANDBOX" "$SANDBOX-terminal" "$STOCK"` How it starts
The opening of the file, as written. The whole thing — 341 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA release
One run per release, never per ticket, and issue-agnostic: it reads what is being released, not a ticket list. Claude Code runs this skill on the Mac and does every bit of setup, typing, polling and timing. Claude Desktop only clicks and looks, from a handoff Claude Code writes: its Bash is a Linux sandbox with no code, specify or gh, and VS Code is click-only for it. QA never edits this repo; failures become fix candidates in the report. The repo stays untouched; the throwaway .vsix goes into the results folder.
/release-qa is the entry point, and step 3 of /release-loop. This skill holds the flow; surface-map.yml holds the checks; the helper scripts in this folder do the mechanical parts.
What each tool can do here
| App | Tier | You can | You cannot |
|---|---|---|---|
| Visual Studio Code | click | left-click, scroll, screenshot | type, press keys, right-click, drag. So no command palette, no typing in the Create Spec box, no terminal input |
| GitHub Copilot | full | everything | - |
| Browsers | read | look | click. Used only to look at changed site pages |
Consequences, designed in: settings are written to a file by Bash, the AI provider runs with auto-approve so its terminal never waits for a keypress, and the one piece of typing VS Code needs (the Create Spec description) is either handed to the user as a paste or done headless by Bash. Look with the computer-use screenshot; save evidence with shot.sh, which writes a real PNG to disk.
Variables
REPO=/Users/alfredoperez/dev/GitHub/speckit-companion
SKILL=$REPO/.claude/skills/release-qa
VAULT=$HOME/dev/GitHub/obsidian-vault
DATE=$(date +%Y-%m-%d)
RUN=$(date +%Y-%m-%d-%H%M)
. "$REPO/.claude/sandboxes-env.sh" # SANDBOXES_REPO, SANDBOXES_DIR, EVIDENCE_DIR
SANDBOX=$SANDBOXES_DIR/e2e-$RUN
STOCK=$SANDBOX-stock
RESULTS=$EVIDENCE_DIR/$DATE-release-qa
Re-declare them in every Bash call; shell state does not persist. $RESULTS is per day: a second run the same day reuses it and its numbered shots. sandboxes-env.sh finds the sibling speckit-sandboxes checkout, whose recipes build every sandbox this skill uses: sandboxes land under its sandbox root ($SANDBOXES_DIR) and results under its evidence/ folder. qa-stage.sh names its own folders from the run name: $SANDBOXES_DIR/qa-<name>, qa-<name>-stock and $EVIDENCE_DIR/<date>-qa-<name>/.
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- canvas-harness/bootstrap.mjs 223 B runs code
- canvas-harness/canvas-checks.sh 1.7 KB runs code
- canvas-harness/checks.mjs 18 KB runs code
- canvas-harness/package-lock.json 16 KB
- canvas-harness/package.json 285 B
- canvas-harness/session.mjs 5.0 KB runs code
- desktop-handoff.md 3.7 KB
- grade-scripted.py 3.5 KB runs code
- launch-vscode.sh 3.1 KB runs code
- qa-stage.sh 5.8 KB runs code
- record-windows.sh 963 B runs code
- setup-sandbox.sh 722 B runs code
- shot.sh 1.0 KB runs code
- surface-map.yml 8.2 KB
- test_grade_scripted.py 4.4 KB runs code
- timing.py 4.1 KB runs code
- trust-claude-folder.py 1.6 KB runs code
- verify-companion-skills.sh 1.2 KB runs code
- windows.swift 545 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed 6bb516918889
- 13d ago Changed 93e06b67bb64
- 14d ago Changed 57cc545e2dc8
- 16d ago Changed · -14 lines 37d1eaf25f73
- 18d ago Changed · +1 lines f1cd1e58012c
- 19d ago Changed · +1 lines 3311d9c24833
- 21d ago Changed · +4 lines 4bb88bf82704
- 23d ago First seen · 349 lines · 174 tokens per session scan C f8f49ffbf361
release-qa is a skill published in the GitHub repository alfredoperez/speckit-companion (99 stars, last pushed 6d ago), licensed MIT. It adds 174 tokens to every session and 7,634 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other skills, from other repositories
pi-package-sandbox-test
Use when verifying that published Pi packages install and load for normal users, including pi.dev package compatibility checks, release validation, Daytona sandbox tests, and package installability audits.
release-gate-loop
A release check that tests a change, reports whether it passes, and can run a limited fix-and-retest cycle. A release is the act of making a software version available.
release-testing-workflow
Use this skill when you need release-phase QA workflow from T-14 planning to go/no-go and post-release monitoring; triggers include release testing workflow and go/no-go QA.
verify-cli
Run smoke tests against the mpak CLI to verify all commands work correctly before publishing a new release.
publish-npm-version
Cuts the next release of Prisma 8: bumps the root package.json version (on the v8 RC line: 8.0.0-rc.N → rc.N+1), propagates it to every workspace package, and opens a PR titled "chore(release): bump to ". When the maintainer merges the PR, the Publish to npm workflow runs automatically and ships the new version to npm…
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.