Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cunhaax/ai-workflow --skill adversarial-qagit clone --depth 1 https://github.com/cunhaax/ai-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cunhaax/ai-workflow/adversarial-qa)<a href="https://agentmods.dev/skills/cunhaax/ai-workflow/adversarial-qa"><img src="https://agentmods.dev/badge/skills/cunhaax/ai-workflow/adversarial-qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01297 |
| Opus 5 | $0.00043 | $0.00648 |
| Sonnet 5 | $0.00017 | $0.00259 |
| Haiku 4.5 | $0.00009 | $0.00130 |
Grade A, and why
adversarial-qa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
is unavailable, STOP and report the blocker. Do not substitute `curl`, How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/adversarial-qa — Exploratory QA
Exercise a feature in the running app and surface anything that looks wrong, confusing, or likely to bite a real user. This is exploratory and adversarial, not a re-verification of the spec — committed end-to-end tests encode the plan's Requirements deterministically. Your job is to go beyond them.
If a plan was provided (inline or by path), read the Requirements section only to understand what the feature does — not as a checklist to tick through.
What to do
-
Determine the surface(s). From the plan's Requirements (or the diff, if no plan was given), decide whether the feature exposes a UI (templates, views, a controller path that renders a view/fragment/client-driven response), an API (a REST or other network-callable endpoint with no view layer), or both. Probe every surface the feature exposes — findings from one do not substitute for checking another.
-
Set up and drive the feature, per surface identified in step 1.
-
UI surface — start the local dev server with the project's dev-server command and drive the feature at the documented app URL (both in
AGENTS.md→ Commands) in a browser via the Playwright MCP. When you are done, stop it with the documented stop command — neverkillby PID or hunt processes withlsof. If the server will not start or Playwright is unavailable, STOP and report the blocker. Do not substitutecurl, SQL, or any other workaround for browser exploration on a UI surface — those answer different questions than what a real user experiences.For mechanical setup with a known, fixed sequence — logging in, navigating through boilerplate screens to reach the feature under test — batch the steps into one
browser_run_code_unsafecall instead of a click/type/snapshot round trip per step; each round trip returns a full accessibility snapshot, which adds up fast. Reserve the granular tools (browser_click,browser_snapshot, etc.) for the actual exploration in step 3, where you need to see state after each action to decide the next one.
-
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 123 lines · 85 tokens per session scan A 833a5da5eca0
adversarial-qa is a skill published in the GitHub repository cunhaax/ai-workflow (5 stars, last pushed 11d ago), licensed MIT. It adds 85 tokens to every session and 1,297 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
test-e2e
Generates end-to-end tests for a user flow using Playwright or Cypress.
playwright-cli
Automates browser interactions for web testing, form filling, screenshots, and data extraction using playwright-cli. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, extract information from web pages, mock network requests, manage browser…
playwright-core
Battle-tested Playwright patterns for E2E, API, component, visual, accessibility, and security testing. Covers locators, assertions, fixtures, network mocking, auth flows, debugging, and framework recipes for React, Next.js, Vue, and Angular. TypeScript and JavaScript.
playwright-ci
Production-ready CI/CD configurations for Playwright — GitHub Actions, GitLab CI, CircleCI, Azure DevOps, Jenkins, Docker, parallel sharding, reporting, code coverage, and global setup/teardown.
playwright-migration
Step-by-step migration guides for moving to Playwright from Cypress or Selenium/WebDriver — command mappings, architecture changes, and incremental adoption strategies.
playwright-pom
Page Object Model patterns for Playwright — when to use POM, how to structure page objects, and when fixtures or helpers are a better fit.