qa-sweep

A structured quality check of a running product using several review angles, including user flows, unusual states, honesty of content, technical contracts, and usability. It collects findings, verifies important ones, and records them as backlog tickets.

In plain words
What is it for?
Preparing the app and its accounts, running the selected QA reviews, confirming significant findings, and saving the results in the project’s qa/ folder.
Why use it?
It helps find problems that may be missed by checking only whether the application starts or basic tests pass.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/awrshift/agent-memory-kit/qa-sweep
Any agent
npx skills add awrshift/agent-memory-kit --skill qa-sweep
Clone the repo
git clone --depth 1 https://github.com/awrshift/agent-memory-kit

Made for: Claude Code, Codex.

Per session 199 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 792 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00199 $0.00792
Opus 5 $0.00100 $0.00396
Sonnet 5 $0.00040 $0.00158
Haiku 4.5 $0.00020 $0.00079

Measured yesterday against content hash 7fce5b08c9c0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-sweep scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

ux-critique. Non-browser: contract (curl) · honesty (curl + read-only store queries).
Origin

This is a copy

100% identical to qa-sweep — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

plugins/memory-kit/skills/qa-sweep/SKILL.md · 46 lines

How it starts

The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Sweep — multi-lens agent QA of the live product

Read projects/<name>/qa/README.md FIRST (the protocol SSOT: environment rules · the five lens briefs · findings format · triage) — the lens briefs in agent prompts come verbatim from there, and the account/mutation policy it sets is a hard rail, not advice. If that file doesn't exist yet, create it from the layer's protocol template (${CLAUDE_PLUGIN_ROOT}/reference/qa-PROTOCOL-TEMPLATE.md in the kit repo — copy it from there if this project only adopted the layer's .claude/ files) and fill the placeholders before sweeping.

Steps

  1. Preflight (integrator, by hand): bring up the stack the protocol names (app · API · store) · pick the account per the protocol's policy (the demo/real account = OBSERVE-ONLY always; the seeded sacrificial account = mutation QA only when the run brief grants it) · make sure nothing else is writing to the shared store during the sweep (no integration test suites, no live jobs).
  2. Pick lenses for this run (default: user-flow + contract in parallel, then edge-state, then honesty + ux-critique). Browser lenses run CONCURRENTLY via the isolated Playwright MCP servers the protocol lists (one server per concurrent browser agent — mechanism + logged-in seed recipe in the protocol § Parallel lenses). Browser lenses: user-flow · edge-state · ux-critique. Non-browser: contract (curl) · honesty (curl + read-only store queries).
  3. Spawn qa agents with the lens brief from the protocol § Lens briefs + the run scope (which screens/flows changed recently — QA the delta first, then one broad pass).
  4. Verify before ticketing (the fact-check rule): reproduce every P1/P2 finding yourself (the named repro steps) before it becomes a ticket. Unreproducible → back to the agent or drop with a note. «Impressions» never become tickets directly.
  5. Land the results: verified findings → backlog tickets (P1/P2) or a minors batch (P3) · one run record projects/<name>/qa/qa-run-YYYYMMDD.md (lenses run · coverage · findings table with verified/dropped status · pointers to tickets) · a row in the protocol's § Runs index.
  6. Cleanup: stop dev servers, remove stray screenshots from the repo root, re-seed the sacrificial account if a mutation run dirtied it.

Read the full file on GitHub · 46 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 46 lines · 199 tokens per session scan A 7fce5b08c9c0

Subscribe to this mod's changes

qa-sweep is a skill published in the GitHub repository awrshift/agent-memory-kit (31 stars, last pushed yesterday), licensed MIT. It adds 199 tokens to every session and 792 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to qa-sweep, differing in 0 lines, and is treated as a copy.

Related

Other skills, from other repositories

kungfu-agent-onboarding

Discover the exact Kungfu Project, WorkConsole, WorkRef, Skill catalog, and Core Work state admitted to this Amp process.

kungfu-systems/kungfu · 32 tokens

kungfu-agent-onboarding

Use when a user asks to understand, start, inspect, extend, or safely operate installed Kungfu; verify the installed pack, select one intent route, personalize the explanation, and propose one smallest safe next action.

kungfu-systems/kungfu · 49 tokens

bridge-sync

End-of-sprint batch-sync: pushes ALL pending scope:core + scope:org commits from the local user branch to BOTH upstreams (open-bridge + your org overlay) in one operation, with per-destination scrubbing and parallel PR creation. Complements /promote (per-commit) and /contribute (per-file) with a sprint-level workflow.…

bks-lab/open-bridge · 118 tokens

briefing

Assembles a session context briefing from your configured issue tracker, recent git history, and active work signals. Use when: starting a new session, resuming after a break, user says 'catch me up', 'what was I working on', 'where did I leave off', context recovery after compaction, or user asks for project…

backchainai/backchain-plugins · 109 tokens

mcaf-agile-delivery

Shape delivery workflow around backlog quality, roles, ceremonies, and engineering feedback. Use when defining how the team plans, tracks work, and turns feedback into durable improvements.

managedcode/dotPilot · 40 tokens

gh-file-issue

Use when filing a new Codewhale GitHub issue: turn a bug or idea into a well-formed, actionable issue with repro, acceptance criteria, labels, and milestone.

Hmbown/CodeWhale · 41 tokens