Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cskwork/oh-my-symphony --skill superqagit clone --depth 1 https://github.com/cskwork/oh-my-symphonyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cskwork/oh-my-symphony/superqa)<a href="https://agentmods.dev/skills/cskwork/oh-my-symphony/superqa"><img src="https://agentmods.dev/badge/skills/cskwork/oh-my-symphony/superqa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cskwork/oh-my-symphony/superqa"><img src="https://agentmods.dev/badge/skills/cskwork/oh-my-symphony/superqa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01357 |
| Opus 5.5 | $0.00000 | $0.00543 |
| Sonnet 5.5 | $0.00000 | $0.00271 |
| Haiku 4.5 | $0.00000 | $0.00136 |
Grade A, and why
superqa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SuperQA - browser QA on anything, for anyone
Contract: simple prompt -> concrete scenarios -> real browser evidence -> report in the user's language. Never claim a check passed without a run directory + report to show.
Mode (classify the request, state it in one line)
| Signal in request | Mode | Route |
|---|---|---|
| "QA this ", vague target, no scenarios yet | EXPLORE-QA | explore live site, generate scenario cases, run them (reference/agent-qa.md) |
| scenarios exist / "run the cases" / feature finished, verify | REGRESSION | superqa run --all --site <site>; diff vs last run (reference/agent-qa.md step 5) |
| "quick check / smoke / is it up" | AUTO | superqa auto <url> --site <site> |
| non-dev wants to create a test by clicking | RECORD | superqa record <url> or TUI n key (reference/tui.md) |
| "every N minutes / daily / automate" | SCHEDULE | superqa schedule add <scenario> --every <min> + daemon (reference/tui.md) |
| "open the QA app / dashboard" | TUI | bash scripts/superqa.sh |
Hard rules
- Site knowledge is local, never committed. Entry URLs, accounts, login quirks,
popup behaviors live in
~/.superqa/sites/<site>/rules.mdand the SQLite var store - never in this repo, never in scenario files pushed anywhere (reference/site-rules.md). - Credentials via the var store only.
superqa vars set <site> username <v>/password <v>; scenarios reference{{username}}/{{password}}. Password-like keys are auto-masked in every report. Never hardcode credentials in YAML or reports. - Evidence or it did not happen. Every run produces
~/.superqa/reports/<stamp>-<name>/report.html+ per-step screenshots. Quote the report path and the pass/fail counts in your summary. - Report in the user's language. Scenario
language:drives report labels; your summary to the user follows the conversation language (reference/report.md). - Side effects are findings, not noise. Console errors, JS exceptions, failed
requests, HTTP 4xx/5xx, unexpected dialogs/popups/tabs are collected on every run,
deduped with counts, and diffed against the previous run (new types = regression
signal). Declare known noise in
~/.superqa/sites/<site>/ignore.yamlinstead of ignoring findings by hand (reference/side-effects.md). - Popups and dialogs never block a run. Engine policy auto-accepts dialogs and
follows new tabs by default; scenario
policy:overrides (reference/scenario-format.md).
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- LICENSE 1.0 KB
- pyproject.toml 652 B
- README.md 558 B
- reference/agent-qa.md 3.2 KB
- reference/report.md 1.4 KB
- reference/scenario-format.md 3.3 KB
- reference/scenario-gen.md 2.0 KB
- reference/side-effects.md 3.8 KB
- reference/site-rules.md 1.7 KB
- reference/tui.md 3.7 KB
- scripts/superqa.sh 1.2 KB runs code
- superqa_tui/__init__.py 95 B runs code
- superqa_tui/__main__.py 52 B runs code
- superqa_tui/admin.py 17 KB runs code
- superqa_tui/app.py 14 KB runs code
- superqa_tui/cli.py 15 KB runs code
- superqa_tui/diff.py 2.6 KB runs code
- superqa_tui/engine.py 26 KB runs code
- superqa_tui/i18n.py 7.3 KB runs code
- superqa_tui/junit.py 2.0 KB runs code
- superqa_tui/recorder_overlay.js 8.6 KB runs code
- superqa_tui/report.py 12 KB runs code
- superqa_tui/scenario.py 7.7 KB runs code
- superqa_tui/scheduler.py 3.1 KB runs code
- superqa_tui/store.py 6.0 KB runs code
- superqa_tui/superqa.tcss 851 B
- superqa_tui/visual.py 3.0 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 0 tokens per session scan A 819884c7c541
superqa is a skill published in the GitHub repository cskwork/oh-my-symphony (35 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,357 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
browser-testing-with-devtools
Automate browser interactions, DOM inspection, and visual tests via Chrome DevTools. Bootstrap on demand.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
browse
Drive a real browser through Aside: open a page, read it, click through a flow, take screenshots, check console errors. (gstack).
cua-driver
Use Cua Driver for desktop or browser tasks that are awkward or unavailable through Bash/APIs, or when the user explicitly wants GUI interaction: app testing, visual bug reproduction, form filling, calendar entry, screenshots, and demo recording. Also covers Cua setup; not OpenAI Codex Computer Use or web research.
create-verification-skill
Create a repo-local verification skill and exhaustive feature map for driving a real app through its UI, CLI, or API. Use for "create a verification skill", "make a verify skill for this repo", or "document how agents can verify this app".
browser-qa
A browser-based quality check for deployed web pages and user flows. It uses browser automation to test rendering, navigation, forms, interactions, responsive behaviour, and accessibility-related issues.