Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/devotts/build-it/full-qanpx skills add DevOtts/build-it --skill full-qagit clone --depth 1 https://github.com/DevOtts/build-itWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.03444 |
| Opus 5 | $0.00041 | $0.01722 |
| Sonnet 5 | $0.00016 | $0.00689 |
| Haiku 4.5 | $0.00008 | $0.00344 |
Grade C, and why
full-qa scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "$CDP_URL/json/version" | python3 -c "import sys,json; d=json.load(sys.stdin); print('Chrome:', d.get('Browser','?'))" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w "%{http_code}" <SERVICE_URL>/health How it starts
The opening of the file, as written. The whole thing — 320 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/full-qa — Autonomous Full QA Suite
You are running an autonomous, project-agnostic QA pipeline. You read a test plan, execute every test, fix bugs as you find them, and deliver a final pass/fail report — without stopping between steps unless a destructive or truly ambiguous action requires confirmation.
This skill incorporates Chrome CDP browser control and iterative bug-fix cycles natively. You do not need to invoke /chrome-cdp-control or /iterate separately.
CDP mechanics live in one shared reference — read ../references/cdp-core.md (relative to this skill's base directory) before any browser work. It canonically owns endpoint resolution (CDP_URL/APP_URL env → grounding/test plan → defaults), the action template, tab selection, the selector ladder, waits, and the failure protocol. Never restate them here; never hardcode a CDP endpoint or app port — parallel runs collide on hardcoded values.
Route guard (cdp-core.md §9): autonomous mode is for TEST ENVIRONMENTS ONLY. If any test case targets the user's authenticated real-Chrome session (their logged-in accounts — posting, sending, buying), REFUSE to run that case autonomously and re-route it to /chrome-cdp-control, whose per-write gate requires explicit user confirmation for each write. Unattended (user asleep) that case ends as BLOCKED/deferred with the reason. There is no autonomous write path on an authenticated session.
Step 0 — INGEST THE TEST PLAN
First action: identify the test plan.
- If the user passed a file path (e.g.,
/full-qa ./E2E-test-plan.md), read that file immediately. - If the user pasted tests inline, extract them from the conversation.
- If neither: ask the user ONE question: "Where is the test plan? Paste it or give me a file path."
From the test plan, extract:
- Service URLs — all
localhost:PORTor external URLs mentioned - Auth credentials — any test user emails/passwords
- Test cases — each scenario with its ID, steps, and pass criteria
- Setup steps — any DB resets, seed commands, or imports required before tests
- Stack info — language, framework, DB type (for tailoring fix strategies)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 320 lines · 82 tokens per session scan C ca58badff4f9
full-qa is a skill published in the GitHub repository DevOtts/build-it (14 stars, last pushed 1mo ago), licensed MIT. It adds 82 tokens to every session and 3,444 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
crewai-multi-agent
Multi-agent orchestration framework for autonomous AI collaboration. Use when building teams of specialized agents working together on complex tasks, when you need role-based agent collaboration with memory, or for production workflows requiring sequential/hierarchical execution. Built without LangChain dependencies…
a0-create-agent
Create a new Agent Zero agent profile (subordinate). Covers where profiles live (user / plugin-distributed / project-scoped), the agent.yaml schema, the prompt inheritance & override model, and optional profile-specific tools and extensions. Use for any "create/add/new agent profile" request.
review-agent
Use when reading code changes with adversarial intent to find bugs, security holes, logic errors, and performance traps.
code-agent
Use when implementing features from specs — reads requirements, writes code with tests, iterates until verification passes.
deploy-agent
Use when ship code through controlled pipeline with verification gates and rollback plans.
planning-agent
Use when decompose complex tasks into executable steps with dependencies, risk assessment, and verification criteria.