Borrowing it
Nothing to install: this file belongs to bex-co/bex. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bex-co/bex/main/.claude/skills/qa-find-bugs-cli/SKILL.mdgit clone --depth 1 https://github.com/bex-co/bexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bex-co/bex/qa-find-bugs-cli)<a href="https://agentmods.dev/skills/bex-co/bex/qa-find-bugs-cli"><img src="https://agentmods.dev/badge/skills/bex-co/bex/qa-find-bugs-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bex-co/bex/qa-find-bugs-cli"><img src="https://agentmods.dev/badge/skills/bex-co/bex/qa-find-bugs-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.04993 |
| Opus 5.5 | $0.00028 | $0.01997 |
| Sonnet 5.5 | $0.00014 | $0.00999 |
| Haiku 4.5 | $0.00007 | $0.00499 |
Grade A, and why
qa-find-bugs-cli scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. Read `scripts/qa-login.sh` and the login instructions in `../qa-find-bugs/SKILL.md`. Use `bash scripts/qa-login.sh --serve` and its one-shot loopback cookie handoff to sign the Playwright browser in with `QA_EMAIL`/`Q How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Live CLI QA → contract diagnosis → researched PM filing
Adapt the customer-journey discipline of ../qa-find-bugs/SKILL.md to the real bex executable against production (https://api.bex.co/v1/). This skill is self-contained; do not execute the dashboard hunt as a prerequisite. Find and research bugs, then schedule fixes; implementing fixes is separate work.
Contract and scope
The pinned Render CLI is the command and wire-contract oracle. Bex imports it; command names, flags, defaults, validation, request construction, output schemas, and exit semantics stay upstream. Bex owns its branding, endpoints, isolated configuration, and documented native additions. A valid upstream request failing against Bex is a server-compatibility candidate first, not a reason to fork the CLI, rewrite requests, or teach the launcher a workaround. Server ownership is a hypothesis to prove, not a conclusion to force.
Read these before probing:
lego/cli/UPSTREAM_RENDER_CLI.mdandlego/cli/go.mod: exact release, commit, and dependency pin. Never substitute latest upstream for the tested pin.docs/bex-cli.md: Bex configuration, OAuth, native additions, and branding boundaries.docs/cli-compatibility-checklist.md: supported commands, partial support, upstream defects, and deliberate non-goals. Historical checkmarks are leads to re-test, not proof of current production behavior..pm/DO_NOT_DO.mdanddocs/ADR018-render-parity.md: excluded work.
Preserve render.yaml, upstream schema/enum names, truthful compatibility version, and protocol identifiers. Help examples, executable identity, docs destinations, and Bex-owned messages should use Bex branding. Do not blindly replace every render string. Documented runtime-copy, User-Agent, and upstream skills-path residuals are not new bugs without a changed requirement or regression. Coding-provider launchers, installation, self-update, and upstream skills management are outside the default hosting sweep.
Parse arguments:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed dd9b074b491b
- 15d ago Changed 89f7cc0f5afc
- 1mo ago Changed aad9ba1f8fc5
- 1mo ago Changed 98191537e336
- 1mo ago Changed · +2 lines 07e82c1ccfea
- 1mo ago First seen · 151 lines · 69 tokens per session scan A 3d2ab824265c
qa-find-bugs-cli is a skill published in the GitHub repository bex-co/bex (574 stars, last pushed today), licensed Apache-2.0. It adds 69 tokens to every session and 4,993 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-10.
Other skills, from other repositories
network-rca
Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect…
pinchtab-dev
Develop and contribute to the PinchTab project. Use when working on PinchTab source code, adding features, fixing bugs, running tests, or preparing PRs. Triggers on "work on pinchtab", "pinchtab development", "contribute to pinchtab", "fix pinchtab bug", "add pinchtab feature".
debugging-failures
Diagnose a failing Ginkgo suite as an agent — always run with --json-report into a predictable temp/gitignored location, read the terminal verdict line, then use jq to extract structured failure details (name, message, file:line, panic value, captured logs). Covers the panicked-vs-failed trap, panic locations pointing…
routing-calibration
Use when calibrating or validating a maintained routing recipe against live model backends, including probe manifests and evidence reports.
dev-cycle
Crawlberg iteration loops codified as Taskfile tasks — alef install/generate/format/bump, core and binding builds, e2e generate/build/test cycles, cleanup tiers, and the mock-server / stale-.so / precompiled-NIF / generated-e2e gotchas. Load when running or debugging crawlberg build, alef regeneration, or e2e…
config-loader-helper
Diagnose configuration-related failures, enumerate required env vars, and guide safe local test setup (no secrets).