Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/awrshift/claude-memory-kit/qa-sweepnpx skills add awrshift/claude-memory-kit --skill qa-sweepgit clone --depth 1 https://github.com/awrshift/claude-memory-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/awrshift/claude-memory-kit/qa-sweep)<a href="https://agentmods.dev/skills/awrshift/claude-memory-kit/qa-sweep"><img src="https://agentmods.dev/badge/skills/awrshift/claude-memory-kit/qa-sweep.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00199 | $0.00792 |
| Opus 5 | $0.00100 | $0.00396 |
| Sonnet 5 | $0.00040 | $0.00158 |
| Haiku 4.5 | $0.00020 | $0.00079 |
Grade A, and why
qa-sweep scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
ux-critique. Non-browser: contract (curl) · honesty (curl + read-only store queries). Copies of this mod
1 near-identical copy found in the catalogue:
- qa-sweep — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Sweep — multi-lens agent QA of the live product
Read projects/<name>/qa/README.md FIRST (the protocol SSOT: environment rules · the five lens briefs ·
findings format · triage) — the lens briefs in agent prompts come verbatim from there, and the
account/mutation policy it sets is a hard rail, not advice. If that file doesn't exist yet,
create it from the layer's protocol template (${CLAUDE_PLUGIN_ROOT}/reference/qa-PROTOCOL-TEMPLATE.md in
the kit repo — copy it from there if this project only adopted the layer's .claude/ files)
and fill the placeholders before sweeping.
Steps
- Preflight (integrator, by hand): bring up the stack the protocol names (app · API · store) · pick the account per the protocol's policy (the demo/real account = OBSERVE-ONLY always; the seeded sacrificial account = mutation QA only when the run brief grants it) · make sure nothing else is writing to the shared store during the sweep (no integration test suites, no live jobs).
- Pick lenses for this run (default: user-flow + contract in parallel, then edge-state, then honesty + ux-critique). Browser lenses run CONCURRENTLY via the isolated Playwright MCP servers the protocol lists (one server per concurrent browser agent — mechanism + logged-in seed recipe in the protocol § Parallel lenses). Browser lenses: user-flow · edge-state · ux-critique. Non-browser: contract (curl) · honesty (curl + read-only store queries).
- Spawn
qaagents with the lens brief from the protocol § Lens briefs + the run scope (which screens/flows changed recently — QA the delta first, then one broad pass). - Verify before ticketing (the fact-check rule): reproduce every P1/P2 finding yourself (the named repro steps) before it becomes a ticket. Unreproducible → back to the agent or drop with a note. «Impressions» never become tickets directly.
- Land the results: verified findings → backlog tickets (P1/P2) or a minors batch (P3) ·
one run record
projects/<name>/qa/qa-run-YYYYMMDD.md(lenses run · coverage · findings table with verified/dropped status · pointers to tickets) · a row in the protocol's § Runs index. - Cleanup: stop dev servers, remove stray screenshots from the repo root, re-seed the sacrificial account if a mutation run dirtied it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 46 lines · 199 tokens per session scan A 7fce5b08c9c0
qa-sweep is a skill published in the GitHub repository awrshift/claude-memory-kit (31 stars, last pushed 7d ago), licensed MIT. It adds 199 tokens to every session and 792 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codex-e2e-test
Run PR-grade real Codex E2E validation through claude-tap, including resume turns, multiple tool calls, optional image input, viewer verification, and screenshot evidence.
js-in-html-testing
Test JS logic embedded in HTML using two-layer strategy - Python unit tests + Playwright browser integration tests.
playwright-screen-recording
Record browser test videos with Playwright for PR review and bug fix verification.
real-e2e-test
Run real E2E tests against Claude CLI in pytest and tmux modes.
e2e-test
Run claude-tap end-to-end tests with pytest.
e2e-verify
面向 Bifrost 管理端的端到端 UI 与 API 验证工具。 适用于浏览器测试、场景回归、管理端接口验证与页面快照排查。 Use when: 端到端验证、功能验证、E2E 测试、UI 测试、浏览器测试、API 测试、接口验证.