Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/danielbirk04/capusqa/issuesnpx skills add DanielBirk04/capusqa --skill issuesgit clone --depth 1 https://github.com/DanielBirk04/capusqaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00088 | $0.01063 |
| Opus 5 | $0.00044 | $0.00531 |
| Sonnet 5 | $0.00018 | $0.00213 |
| Haiku 4.5 | $0.00009 | $0.00106 |
Grade A, and why
issues scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
that env var is set. `curl -s $BASE/api/status` first — no response ⇒ `capusqa Copies of this mod
1 near-identical copy found in the catalogue:
- capusqa-issues — 89% identical, 27 lines differ
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/capusqa:issues — findings & fixes (Issues found)
The dashboard Issues board, in chat: every finding from every run, grouped into clusters, with triage + the coding-tool handoff. Read/written through the daemon, so it matches the dashboard and persists.
Reaching the daemon
BASE = the capusqa URL in .mcp.json (default http://127.0.0.1:7777). GET =
no auth; POST adds -H "Authorization: Bearer $CAPUSQA_DASHBOARD_TOKEN" only if
that env var is set. curl -s $BASE/api/status first — no response ⇒ capusqa serve (see /capusqa:help).
Show issues
curl -s "$BASE/api/findings?limit=200" (filters: status
open|fixed|wontfix|duplicate, severity critical|high|medium|low, run_id) →
{findings:[…], finding_groups:[…], runs:[…]}. Prefer finding_groups — the
dashboard's unit is the cluster ("found N times"), not the raw finding.
Render by severity, hot (critical/high) first: summary, expected vs observed,
count, status, which run(s)/mode(s) it appeared in. For deeper triage the
findings_query / issues_query MCP tools also work.
The feed honors the user's severity floor (Settings → Findings, the
/capusqa:settings Findings area): below-floor findings are hidden — medium
(the default) hides low, high also hides medium, all shows
everything. The response carries the applied min_severity + a
hidden_below_floor count; add &min_severity=all to one request to see
everything regardless of the floor. Mention the count if anything is hidden so
"nothing shown" is never mistaken for "nothing found". The same floor is what
the hand-off considers (and, when automatic fixing ships, what the
auto-improvement loop may fix).
Triage — mark fixed · rate · re-test
The Issues board's per-issue actions, all POST $BASE/api/findings/<finding_id>
(authed, content-type: application/json):
- Mark fixed:
-d '{"status":"fixed","fix_note":"<why>"}'. (The APIstatusalso acceptsopen|wontfix|duplicate, though the board's button only marks fixed.) - Rate helpful / not helpful (the 👍/👎 on each issue — feeds fleet scoring):
-d '{"user_rating":"up"}'(or"down", or"none"to clear). - Re-test: see below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 67 lines · 88 tokens per session scan A 74a59f0e4bed
issues is a skill published in the GitHub repository DanielBirk04/capusqa (0 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 88 tokens to every session and 1,063 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
use-agent-browser-for-airi
Test AIRI display-model imports with agent-browser across stage-tamagotchi Electron, stage-web, and stage-pocket mobile web layouts. Use when uploading and verifying contributor-supplied Live2D ZIP, VRM, or MMD ZIP/PMX/PMD files through AIRI's model selector, including onboarding bypass, format-specific import…
test-conversion
Workflow for converting unit tests to browser tests for Project Bedrock. Invoke this when the user wants to remove complex Browser dependencies from tests.
agui-dotnet-cross-language-tests
Author cross-language interop tests that verify the AG-UI .NET SDK is wire-compatible with the TypeScript SDK — a Vitest TS client driving a C# CrossLanguage.TestServer over HTTP, both directions, including protobuf byte-parity against @ag-ui/proto. USE FOR: adding or modifying cross-language interop coverage…
cli-e2e-testcase-writer
Use when adding or updating Go CLI E2E coverage for one tests/clie2e/{domain} domain of the compiled lark-cli, especially when the work requires live --help or schema exploration, scenario-based clie2e.RunCmd workflows, and per-domain coverage.md maintenance.
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
develop-web-game
Use when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with rendergametotext.