Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/danielbirk04/capusqa/capusqa-issuesnpx skills add DanielBirk04/capusqa --skill capusqa-issuesgit clone --depth 1 https://github.com/DanielBirk04/capusqaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.01096 |
| Opus 5 | $0.00046 | $0.00548 |
| Sonnet 5 | $0.00018 | $0.00219 |
| Haiku 4.5 | $0.00009 | $0.00110 |
Grade B, and why
capusqa-issues scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`BASE` = the `capusqa` MCP server URL from `~/.codex/config.toml` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
$CAPUSQA_DASHBOARD_TOKEN"` **only if** that env var is set. `curl -s $BASE/api/status` This is a copy
89% identical to issues — 27 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
capusqa-issues — findings & fixes (Issues found)
The dashboard Issues board, in Codex: every finding from every run, grouped into clusters, with triage + the coding-tool handoff. Read/written through the daemon, so it matches the dashboard and persists.
Reaching the daemon
BASE = the capusqa MCP server URL from ~/.codex/config.toml
([mcp_servers.capusqa] url = "http://127.0.0.1:7777/mcp" → BASE =
http://127.0.0.1:7777). GET = no auth; POST adds -H "Authorization: Bearer $CAPUSQA_DASHBOARD_TOKEN" only if that env var is set. curl -s $BASE/api/status
first — no response ⇒ capusqa serve (see $capusqa-help).
Show issues
curl -s "$BASE/api/findings?limit=200" (filters: status
open|fixed|wontfix|duplicate, severity critical|high|medium|low, run_id) →
{findings:[…], finding_groups:[…], runs:[…]}. Prefer finding_groups — the
dashboard's unit is the cluster ("found N times"), not the raw finding.
Render by severity, hot (critical/high) first: summary, expected vs observed,
count, status, which run(s)/mode(s) it appeared in. For deeper triage the
findings_query / issues_query MCP tools also work.
The feed honors the user's severity floor (Settings → Findings, the
$capusqa-settings Findings area): below-floor findings are hidden — medium
(the default) hides low, high also hides medium, all shows
everything. The response carries the applied min_severity + a
hidden_below_floor count; add &min_severity=all to one request to see
everything regardless of the floor. Mention the count if anything is hidden so
"nothing shown" is never mistaken for "nothing found". The same floor is what
the hand-off considers (and, when automatic fixing ships, what the
auto-improvement loop may fix).
Triage — mark fixed · rate · re-test
The Issues board's per-issue actions, all POST $BASE/api/findings/<finding_id>
(authed, content-type: application/json):
- Mark fixed:
-d '{"status":"fixed","fix_note":"<why>"}'. (The APIstatusalso acceptsopen|wontfix|duplicate, though the board's button only marks fixed.) - Rate helpful / not helpful (the 👍/👎 on each issue — feeds fleet scoring):
-d '{"user_rating":"up"}'(or"down", or"none"to clear). - Re-test: see below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 68 lines · 91 tokens per session scan B cb2b947e17cd
capusqa-issues is a skill published in the GitHub repository DanielBirk04/capusqa (0 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 91 tokens to every session and 1,096 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). It is 89% identical to issues, differing in 27 lines, and is treated as a copy.
Other skills, from other repositories
use-agent-browser-for-airi
Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…
test-conversion
Workflow for converting unit tests to browser tests for Project Bedrock. Invoke this when the user wants to remove complex Browser dependencies from tests.
agui-dotnet-cross-language-tests
Author cross-language interop tests that verify the AG-UI .NET SDK is wire-compatible with the TypeScript SDK — a Vitest TS client driving a C# CrossLanguage.TestServer over HTTP, both directions, including protobuf byte-parity against @ag-ui/proto. USE FOR: adding or modifying cross-language interop coverage…
cli-e2e-testcase-writer
Use when adding or updating Go CLI E2E coverage for one tests/clie2e/{domain} domain of the compiled lark-cli, especially when the work requires live --help or schema exploration, scenario-based clie2e.RunCmd workflows, and per-domain coverage.md maintenance.
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
develop-web-game
Use when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with rendergametotext.