Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DevOtts/build-it --skill full-qagit clone --depth 1 https://github.com/DevOtts/build-itWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/devotts/build-it/full-qa)<a href="https://agentmods.dev/skills/devotts/build-it/full-qa"><img src="https://agentmods.dev/badge/skills/devotts/build-it/full-qa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/devotts/build-it/full-qa"><img src="https://agentmods.dev/badge/skills/devotts/build-it/full-qa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.03444 |
| Opus 5.5 | $0.00033 | $0.01378 |
| Sonnet 5.5 | $0.00016 | $0.00689 |
| Haiku 4.5 | $0.00008 | $0.00344 |
Grade C, and why
full-qa scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "$CDP_URL/json/version" | python3 -c "import sys,json; d=json.load(sys.stdin); print('Chrome:', d.get('Browser','?'))" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w "%{http_code}" <SERVICE_URL>/health How it starts
The opening of the file, as written. The whole thing — 320 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/full-qa — Autonomous Full QA Suite
You are running an autonomous, project-agnostic QA pipeline. You read a test plan, execute every test, fix bugs as you find them, and deliver a final pass/fail report — without stopping between steps unless a destructive or truly ambiguous action requires confirmation.
This skill incorporates Chrome CDP browser control and iterative bug-fix cycles natively. You do not need to invoke /chrome-cdp-control or /iterate separately.
CDP mechanics live in one shared reference — read ../references/cdp-core.md (relative to this skill's base directory) before any browser work. It canonically owns endpoint resolution (CDP_URL/APP_URL env → grounding/test plan → defaults), the action template, tab selection, the selector ladder, waits, and the failure protocol. Never restate them here; never hardcode a CDP endpoint or app port — parallel runs collide on hardcoded values.
Route guard (cdp-core.md §9): autonomous mode is for TEST ENVIRONMENTS ONLY. If any test case targets the user's authenticated real-Chrome session (their logged-in accounts — posting, sending, buying), REFUSE to run that case autonomously and re-route it to /chrome-cdp-control, whose per-write gate requires explicit user confirmation for each write. Unattended (user asleep) that case ends as BLOCKED/deferred with the reason. There is no autonomous write path on an authenticated session.
Step 0 — INGEST THE TEST PLAN
First action: identify the test plan.
- If the user passed a file path (e.g.,
/full-qa ./E2E-test-plan.md), read that file immediately. - If the user pasted tests inline, extract them from the conversation.
- If neither: ask the user ONE question: "Where is the test plan? Paste it or give me a file path."
From the test plan, extract:
- Service URLs — all
localhost:PORTor external URLs mentioned - Auth credentials — any test user emails/passwords
- Test cases — each scenario with its ID, steps, and pass criteria
- Setup steps — any DB resets, seed commands, or imports required before tests
- Stack info — language, framework, DB type (for tailoring fix strategies)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 320 lines · 82 tokens per session scan C ca58badff4f9
full-qa is a skill published in the GitHub repository DevOtts/build-it (16 stars, last pushed 8d ago), licensed MIT. It adds 82 tokens to every session and 3,444 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-e2e-test-specialist
Specialist subagent: Playwright, Cypress, and visual regression testing specialist. Use only when the user explicitly asks for E2E tests, browser test automation, or visual regression testing. Trigger phrases: E2E, end-to-end, Playwright, Cypress, visual regression, browser test, screenshot test, Percy, Chromatic.
browser-qa
Use this skill to automate visual testing and UI interaction verification using browser automation after deploying features.
e2e-testing-patterns
Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
browser-testing-with-devtools
Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.
playwright-skill
Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions…