Borrowing it
Nothing to install: this file belongs to c9r-io/orchestrator. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/c9r-io/orchestrator/main/.claude/skills/qa-doc-gen/SKILL.mdgit clone --depth 1 https://github.com/c9r-io/orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-gen)<a href="https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-gen"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-doc-gen/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-gen"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-doc-gen.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00143 | $0.03074 |
| Opus 5 | $0.00072 | $0.01537 |
| Sonnet 5 | $0.00029 | $0.00615 |
| Haiku 4.5 | $0.00014 | $0.00307 |
Grade A, and why
qa-doc-gen scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
4. **Dynamic values**: Use `{placeholder}` syntax in SQL and curl commands How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Doc Gen
After a feature plan is confirmed or a refactor is completed, generate and synchronize test documentation so all QA/security/UIUX docs match real behavior.
Workflow
1. Extract feature details and behavior deltas from confirmed plan / implemented code
2. Determine module classification and file naming
3. Generate design doc(s) under docs/design_doc/ (platform doc, before QA)
4. Generate QA test document(s) following project format
5. Run cross-doc impact scan on docs/qa, docs/security, docs/uiux
6. Patch all impacted existing docs to remove stale steps/assertions
7. Update docs/qa/README.md index
8. Update docs/design_doc/README.md index
9. Update docs/security/README.md and docs/uiux/README.md when changed
Step 1: Extract from Confirmed Plan
From the confirmed plan and merged implementation, extract:
- Feature name: What the feature is called
- Module: Which module it belongs to (used as the folder under
docs/qa/, e.g.docs/qa/{module}/) - Behavior: Normal flow, error cases, edge cases
- Behavior deltas: What changed compared to old docs (auth rules, token types, permission boundaries, UI routes, API contracts, redirects)
- Falsified statements: Which existing statements anywhere in the repo this change makes untrue — a removed config value still documented as available, a mechanism still described as current, a compatibility claim that no longer holds. List these explicitly; they drive Step 5 and are the most common source of doc drift surviving a "closed" change.
- UI interactions: Pages, buttons, forms involved
- UI entry points: Navigation links, quick links, sidebar items, or buttons that lead to the feature
- API endpoints: If applicable, include method, path, request/response
- Database changes: New tables/columns, expected data states
- Acceptance criteria: What constitutes correct behavior
- Non-functional requirements: Security/perf/availability/observability notes if present in the plan
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 227 lines · 143 tokens per session scan A 2d7714511469
qa-doc-gen is a skill published in the GitHub repository c9r-io/orchestrator (21 stars, last pushed 7d ago), licensed MIT. It adds 143 tokens to every session and 3,074 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cw-dogfood
Use when a Codewhale change needs proving in the real product, or when asked to build/install/dogfood the local binaries: stamped release build, atomic install, fresh-shell verification, and the manual QA that gates cannot cover.
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
webapp-testing
Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.
issue-to-pr
Implement one bounded repository issue with normal host tools, prove the tested change through one scafld finalize wall, and optionally publish the exact pull request through scoped provider authority with readback.