Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add coo1white/cool-workflow --skill design-qagit clone --depth 1 https://github.com/coo1white/cool-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coo1white/cool-workflow/design-qa)<a href="https://agentmods.dev/skills/coo1white/cool-workflow/design-qa"><img src="https://agentmods.dev/badge/skills/coo1white/cool-workflow/design-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/coo1white/cool-workflow/design-qa"><img src="https://agentmods.dev/badge/skills/coo1white/cool-workflow/design-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00360 |
| Opus 5.5 | $0.00024 | $0.00144 |
| Sonnet 5.5 | $0.00012 | $0.00072 |
| Haiku 4.5 | $0.00006 | $0.00036 |
Grade A, and why
design-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Design QA
Overview
Design QA checks whether a proposed capability belongs in the kernel, userland, a manifest, a wrapper, a routine, or an eval before implementation.
Workflow
- State the user capability in one sentence.
- Identify the contract surface: CLI, MCP,
.cw/state, file layout, docs, package contents, or external wrapper. - Separate mechanism from policy. Move policy into data, apps, wrappers, env, or docs.
- Check POLA: existing outputs, flags, exit codes, and file layouts stay byte-identical unless a new opt-in surface is used.
- Define verifier evidence: tests, manifests, screenshots for UI, replay, or logs.
- Decide whether the work needs a new eval case or skill update.
Checks
- Does it preserve stdout-as-data?
- Does it fail closed instead of guessing?
- Does it avoid vendor-specific parsing in
src/? - Does it keep generated files verifiable?
- Does it have a man page or docs contract?
- Can maker and verifier run in separate worktrees?
Output Rules
Return:
- Verdict: acceptable, revise, or reject.
- Required contract shape.
- Verification plan.
- Risks and non-goals.
Do not turn design QA into implementation unless the user asks to proceed.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 50 lines · 61 tokens per session scan A 73563f70f7c5
design-qa is a skill published in the GitHub repository coo1white/cool-workflow (2 stars, last pushed 4d ago), licensed BSD-2-Clause. It adds 61 tokens to every session and 360 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pi-package-sandbox-test
Use when verifying that published Pi packages install and load for normal users, including pi.dev package compatibility checks, release validation, Daytona sandbox tests, and package installability audits.
build-swiftui-interface
Use when a coding agent must design, scaffold, implement, or verify an iOS or macOS SwiftUI interface with Apple-platform state, accessibility, availability, testing, and Xcode evidence.
verify
Drive the real CLI (node n8n-decanter.mts ) as a subprocess against a throwaway mock n8n API — do not import lib/ modules directly.
github-copilot-upgrader
Use this to update the Github Copilot CLI/SDK.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.