Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bex-co/bex/qa-find-bugsnpx skills add bex-co/bex --skill qa-find-bugsgit clone --depth 1 https://github.com/bex-co/bexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bex-co/bex/qa-find-bugs)<a href="https://agentmods.dev/skills/bex-co/bex/qa-find-bugs"><img src="https://agentmods.dev/badge/skills/bex-co/bex/qa-find-bugs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.05066 |
| Opus 5 | $0.00048 | $0.02533 |
| Sonnet 5 | $0.00019 | $0.01013 |
| Haiku 4.5 | $0.00010 | $0.00507 |
Grade A, and why
qa-find-bugs scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| 2 | Create a web service from a public repo (e.g. `examples/hello-go`) | build log streams, deploy reaches Live, the `.onbex.co` URL actually serves — `curl -sSI` it outside the browser too | How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Task: live QA hunt of bex hosting → researched fixes → /pm filing → /ship
Use the product the way a paying customer would, on production (https://dashboard.bex.co), find bugs in the hosting features, work out the actual fix in this repo, file only what is not already filed, and land the board entry.
Parse $ARGUMENTS:
wN— target workstream for the filing. Defaultw6.- surface names (
services,deploys,env,domains,scaling,logs,metrics,shell,static,cron,databases,keyvalue,blueprints,projects) — restrict the sweep. Default: the whole hosting sweep in Phase 2. DRY_RUN=1— run Phases 0–5 and report; write nothing to.pm/, do not/ship.
Phase 0 — Preflight
git rev-parse --abbrev-ref HEADmust bemain; if not, STOP and ask (Phase 7 ships).git status --porcelain— record what was already dirty. Phase 7 must not sweep it in.- Confirm the Playwright MCP browser tools are available. Screenshots go to
.playwright-mcp/(configured--output-dir) — always pass bare filenames, namedqa-<surface>-<n>.png. - Never read
.envyourself.Read(.env)is denied by project policy, and the QA password must never reach the transcript, a scratch file, a screenshot, a.pmnote, or a commit.
Phase 1 — Sign in without ever seeing the password
scripts/qa-login.sh does the whole login. It reads QA_EMAIL/QA_PASSWORD from .env inside its own process, completes the Kratos password flow, and hands back only cookies — the password never reaches your context, a file, or a tool call. Never read .env yourself (Read(.env) is denied by project policy), and never type a password into browser_type.
-
Get a session, preferring the one-shot loopback form:
bash scripts/qa-login.sh --serve # prints: ok http://127.0.0.1:<port>/<token>.jsonIt keeps the session state in memory and serves it once, on loopback, at an unguessable path, then exits. Nothing lands on disk.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 199 lines · 96 tokens per session scan A e2c583fc4dc2
qa-find-bugs is a skill published in the GitHub repository bex-co/bex (420 stars, last pushed today), licensed Apache-2.0. It adds 96 tokens to every session and 5,066 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gen-test
Generate idiomatic tests for Go packages and handlers in the Meshery project.
bump-go-version
Bumps the Go version to the latest release across go.mod, tools.mod, and Dockerfiles.
project-writing-go-modules-framework-v2
Use when creating or migrating a Go go.d collector to framework V2, touching CollectorV2, metrix.CollectorStore, ChartTemplateYAML/charts.yaml, charttpl/chartengine, V2 host scopes/vnodes, or V2 collector tests. Focuses on concise maintainer-preferred V2 collector patterns.
project-go-collector-design
Early design decisions for Go go.d collectors, made before code. Use when designing a new go.d collector; when adding, renaming, removing, or changing the default of a config option or mode; when adding or changing a Function; when changing what a metric means or which entities become charts or vnodes; when a…
mariadb-operator-pr-review
Perform a structured maintainer-style PR review for the mariadb-operator repository. Gathers PR context, triages the change, and evaluates correctness, safety, pitfalls, backwards compatibility and code quality against the project conventions documented in AGENTS.md. Use whenever the user mentions a mariadb-operator…
mariadb-operator-comment
Post a comment (or a formal PR review) to a GitHub issue or pull request in mariadb-operator/mariadb-operator. Use whenever the user wants to publish something to GitHub for this repo — "comment on issue #123", "post this as a PR comment", "leave a note on #456", "reply on the PR" — and especially when they want the…