Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add anton-abyzov/specweave --skill qagit clone --depth 1 https://github.com/anton-abyzov/specweaveWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anton-abyzov/specweave/qa)<a href="https://agentmods.dev/skills/anton-abyzov/specweave/qa"><img src="https://agentmods.dev/badge/skills/anton-abyzov/specweave/qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00550 |
| Opus 5 | $0.00020 | $0.00275 |
| Sonnet 5 | $0.00008 | $0.00110 |
| Haiku 4.5 | $0.00004 | $0.00055 |
Grade A, and why
qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
QA Assessment
A thin wrapper over specweave qa — the deterministic part is the CLI's job.
QA scores risk and lists blockers; it is not the code review (sw:review)
and not the closure gate (specweave verify → reports/verify.json).
Commands
| Intent | Command |
|---|---|
| Quick score (default) | specweave qa <id> |
| Before implementing | specweave qa <id> --pre |
| Comprehensive gate check | specweave qa <id> --gate |
| Multi-agent deep pass | specweave qa <id> --full |
| In CI (exit 1 on FAIL) | specweave qa <id> --ci |
| Rule-based only, no model call | specweave qa <id> --no-ai |
| Turn blockers into tasks | specweave qa <id> --export |
--export appends the blockers to tasks.md as new ### T-NN definitions; claim
them with specweave task claim like any other task.
Steps
- Run the command for the intent above. Pass the increment id explicitly — QA never guesses.
- Read the verdict (PASS / CONCERNS / FAIL) and the risk score out loud, then the blockers.
- Blockers are work, not commentary:
--exportthem, or fix them now and re-run. - If the verdict is FAIL and the user wants to close anyway, that is
specweave complete <id> --reason "<why>"— recorded inmetadata.json, not silently skipped.
Rules
- Report the CLI output verbatim when it fails; do not paraphrase a FAIL into "mostly fine".
- QA does not replace
specweave verify(tests/lint/build evidence) orsw:review(adversarial fresh-context reading). Closure needsverify.json; QA is advisory. --no-aiis the offline / no-budget path and is always allowed.
Resources
specweave qa --help- Official Documentation
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 46 lines · 40 tokens per session scan A 2883261dac4c
qa is a skill published in the GitHub repository anton-abyzov/specweave (159 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 550 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
genie-orca-review
Independent, read-only review of a group, a wish, or a PR on Orca — SHIP / FIX-FIRST / BLOCKED with severity-tagged findings. Council and retro are this skill with a different input.
argot-check
Score your working changes with argot — flag code foreign to this repo's own patterns (unfamiliar dependencies, APIs, constructs), functions the repo already has, code filed in the wrong place, imports that break the repo's layering, and tests weakened, disabled, or deleted alongside a production change — before…
go-conventions
Go code conventions covering Effective Go, error wrapping, golangci-lint, govulncheck, table-driven tests, interfaces, context usage, modules, and concurrency. Load when writing or reviewing Go code.
pyo3-bindings
PyO3 conventions for exposing a Rust core to Python: pyclass/pymethods, PyErr/PyResult error mapping, GIL release, properties, maturin builds, and pytest. Load when generating or reviewing PyO3 Python bindings for a Rust library.
bindings
Cross-language binding architecture rules: bindings as minimal glue, canonical API surface ordering (core, ABI, language), per-language test suites in CI, generated-code discipline, and error/async boundary preservation. Load when designing or reviewing polyglot language bindings for a shared core.
ralphctl-test-driven-development
Execute-phase skill — write the failing test before the code that makes it pass; for bug fixes, this is the reproduction test itself. Use for any logic change, bug fix, or behavioural modification; for the full root-cause triage pipeline around an unexpected failure, see ralphctl-debugging-and-error-recovery.