Borrowing it
Nothing to install: this file belongs to cognesy/instructor-php. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cognesy/instructor-php/main/.codex/skills/instructor-qa/SKILL.mdgit clone --depth 1 https://github.com/cognesy/instructor-phpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cognesy/instructor-php/instructor-qa)<a href="https://agentmods.dev/skills/cognesy/instructor-php/instructor-qa"><img src="https://agentmods.dev/badge/skills/cognesy/instructor-php/instructor-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cognesy/instructor-php/instructor-qa"><img src="https://agentmods.dev/badge/skills/cognesy/instructor-php/instructor-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.01118 |
| Opus 5.5 | $0.00026 | $0.00447 |
| Sonnet 5.5 | $0.00013 | $0.00224 |
| Haiku 4.5 | $0.00006 | $0.00112 |
Grade A, and why
instructor-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Instructor QA
This skill is the repo-local quality assurance specialist for InstructorPHP. It chooses the smallest sufficient verification set for simple work, and for complex or multi-step QA it turns the work into a deterministic bd plan and executes it methodically.
Treat these files as source of truth:
QUALITY.mdfor verification lanes and command entrypointsCONTRIBUTING.mdfor contributor workflow expectationsAGENTS.mdfor repo-specific operating rules andbdusage.github/workflows/php.ymlfor the compatibility matrix.actrcfor localactdefaults
Read references/scenarios.md when you need the scenario-to-command mapping or the complex QA playbooks.
When To Use
Use this skill when the user asks to:
- run QA or decide which checks to run
- validate a feature, fix, refactor, dependency upgrade, or release candidate
- investigate a failing test, linter, docs QA run, or GitHub Actions workflow
- reproduce CI locally with
act - assess regression risk, production readiness, or verification gaps
- audit quality across multiple packages, layers, or tooling lanes
Working Model
Start by classifying the request into one or more QA lanes:
- behavior tests:
composer test,composer test-all, targeted Pest runs - integration and live-backend validation: telemetry interop and other opt-in suites
- static analysis: PHPStan, Psalm, dead-code, unused dependency checks
- structural and policy checks: Pint, Semgrep
- docs quality:
composer qa:docs, docs drift, andcomposer qa:docs-sitesfor deployable-site changes - dependency and compatibility validation: Composer resolution plus workflow matrix cells
- CI and workflow reproduction:
actagainst.github/workflows/php.yml - performance: PHPBench
Prefer the smallest sufficient lane set first. Expand only when the risk profile justifies it.
Default Execution Flow
- Read the request, changed files, and the relevant sections of
QUALITY.md. - Identify risk shape:
- local implementation
- docs/examples
- dependency or Composer manifest change
- workflow or CI change
- cross-package or release-sensitive change
- Choose the minimum verification bundle that can falsify the risky assumptions.
- Run checks from fast/high-signal to broader/slower.
- Separate failures caused by the current change from pre-existing repository debt.
- Report exactly what ran, what passed, what failed, what was skipped, and the residual risk.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 109 lines · 65 tokens per session scan A d19ad86e578d
instructor-qa is a skill published in the GitHub repository cognesy/instructor-php (328 stars, last pushed 15d ago), licensed MIT. It adds 65 tokens to every session and 1,118 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-prs
Review a GitHub pull request in the googleapis/mcp-toolbox repo against the team's reviewer checklist: PR title/description conventions, linked issue, logic errors and unhandled edge cases, breaking changes, test coverage, docs updates, security (input handling), and new dependencies. Use whenever a maintainer asks…
fix-failing-tests
Diagnose a failing test in the googleapis/mcp-toolbox repo and land a fix by reasoning from the actual error: read the failure, reproduce it, shrink it until the cause is forced into the open, then fix the cause. Use this whenever a test or CI job is red, a build breaks after a change, many packages fail at once, or a…
reproduce-bug
Reproduce a reported bug in googleapis/mcp-toolbox and decide whether it is real, delivering an evidence-backed verdict: confirmed, already fixed, misconfiguration, client-side, works as intended, not reproducible, or blocked. Use whenever a maintainer asks you to reproduce, verify, confirm, or investigate a bug…
building-pydantic-ai-agents
Build AI agents with Pydantic AI — tools, capabilities (including on-demand loading), workspaces, structured output, streaming, testing, and multi-agent patterns. Use when the user mentions Pydantic AI, imports pydanticai, or asks to build an AI agent, add tools/capabilities, attach a workspace, defer capability…
credit-note-fixer
Fix the tiny credit-note formatting bug and rerun the exact targeted test command.
verify-omnigent
Drive Omnigent the way a user does and prove a behavior with recorded evidence, using an isolated server, runner, and mock model plus a feature map of every user entry point. Load before reproducing a user-facing bug, before claiming a fix works, or when reviewing whether a change covered every surface (session vs.…