x-qa-gate

x-qa-gate is a skill for Claude Code from KtKID/x-dev-pipeline. It costs 69 tokens per session (1,147 once invoked), scanned A, original, MIT.

A quality-review gate for completed development tasks. It checks the code against the request, design, tests, verification evidence, and current changes, using different review rounds for different risk levels.

In plain words
What is it for?
Use it after automated verification to review Q2 or Q3 tasks. Reviewers list issues with locations and severity, while the x-fix process records and repairs them.
Why use it?
It helps catch contract mistakes, boundary problems, and tests that do not really prove the requested behavior before delivery.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \.

Part of the x-dev-pipeline plugin — 12 skills shipped together

Good fit Use it after automated verification to review Q2 or Q3 tasks. Reviewers list issues with locations and severity, while the x-fix process records and repairs them.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/KtKID/x-dev-pipeline
agentmods
npx agentmods add skills/ktkid/x-dev-pipeline/x-qa-gate

Made for: Claude Code.

Or install x-dev-pipeline, the plugin that ships this one along with the rest of its 12 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for x-qa-gate

README.md
[![agentmods](https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate.svg)](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate)
Your own site
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate.svg" alt="Measured on agentmods" height="20"></a>
Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,147 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00069 $0.01147
Opus 5 $0.00034 $0.00574
Sonnet 5 $0.00014 $0.00229
Haiku 4.5 $0.00007 $0.00115

Measured 8d ago against content hash 159b66cab6c3, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

x-qa-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/x-qa-gate/SKILL.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

x-qa-gate · Gate ②

路由

读取 README 唯一的 risk: 字段:Q2 使用 RC;Q3 使用 R1→R2→R3;Q0/Q1 被显式调用时按 Q2 处理并在回执说明。Gate ① verify exit 0 是进入条件。

事实源

  1. 用户原始请求、已确认 spec、既有公开契约。
  2. 真实调用方、schema/数据约束、改动前测试契约。
  3. README 的需求要点、验收、架构拆分策略、技术设计与 dev-checklist。
  4. dev-report verify 块、verify JSON 或失败报告、当前 diff。

输入裁剪

Reviewer 必读输入
RC diff + README 验收/架构拆分策略 + dev-report
R1 diff + README 需求要点/验收
R2 diff + README 技术设计/架构拆分策略
R3 diff + dev-report verify 块 + 测试文件

主 agent 提供文件路径、节名、git diff --statgit diff --name-only 和按需 diff 命令。reviewer 按需读取源代码与测试文件。

Review 纪律

  • RC 一轮覆盖契约、边界、测试真实性;Q3 严格串行 R1、R2、R3。
  • 每个 reviewer 独立、只读,只返回 review 回执;x-fix 负责改动。
  • 每轮穷尽检查范围后一次返回全部问题候选,并声明“已检查范围内无其他 P0/P1”。
  • 每条候选固定提供 taskseveritylocmsgtask 可为 T2,T3severity 为 P0/P1/P2,locfile:linemsg 为单条问题描述。
  • reviewer 省略 issue ID。主 agent 调用 flag 后使用其 JSON issue 字段建立编号映射。
  • P0 需要位置与可复现依据;证据不完整时降级。P0 或未处置 P1 使本轮 fail;P2 登记且保持非阻塞。

issue 登记

主 agent 按 reviewer 返回顺序逐条执行:

python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \
    --loc src/a.py:10 --msg "空输入未处理" [--new-round] --json
  1. 本轮第一条候选添加 --new-round;后续候选追加到同一 ledger。
  2. 保存 JSON 返回的 issuedowngradedreportrecovered,把 issue ID 回填到交给 x-fix 的问题映射。
  3. recovered:true 表示命令完成了上一笔 pending 事务;主 agent 使用原参数再次调用,完成本条候选登记。
  4. flag 是 issue ledger 与 P0/P1 checklist 降级的唯一写入口。reviewer、子 agent 与 x-fix 保持这两处原样。
  5. 本轮无问题时省略 ledger 创建,直接进入 Gate pass 回执。

回流

本轮存在 P0/P1 时,主 agent 把带 issue-<n> 的完整问题映射交给 x-fix gate-fix。修复后复审对应 issue 与 fix diff;fix 扩大到新文件时纳入新文件,公开 API 签名变化时重做相关契约对照。reports/.fix-counter 是 verify 与 qa-gate 共享的批量修复轮数,保留三轮上限;Gate ② 最终 pass 写回 0。

Prompt 模板

Agent({
  description: "<RC/R1/R2/R3> review round <N>",
  subagent_type: "general-purpose",
  prompt: <对应 reference + task root + 输入裁剪表指定路径/节 + diff 命令 + 输出格式>
})

回执与状态

问题 ledger 由 flag 写入 reports/qa-gate/qa-gate-report-<timestamp>[-NN].md。通过时输出:

🛡️ Gate② ✅ · <task> · Q2 RC / Q3 R1→R2→R3 · P0 ×0 · P1 ×0

Read the full file on GitHub · 78 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 78 lines · 69 tokens per session scan A 159b66cab6c3

Subscribe to this mod's changes

x-qa-gate is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 1,147 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

procoder

Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…

azrtydxb/procoder · 101 tokens

goal-test

A local experiment for testing a goal command that keeps an AI coding session working until a stated condition is judged complete. It uses a separate language model to evaluate the conversation after each assistant turn.

restarter/lets-workflow · 137 tokens

loop-test

A local experiment for designing repeating checks with Claude Code’s loop command. It covers both fixed intervals and checks that schedule themselves again after each run.

restarter/lets-workflow · 112 tokens

test-audit

Audit test suites for T1-T4 violations using AST analysis, mock detection, and multi-stage synthesis. Invoke when user asks to audit tests, check test quality, find mock violations, review test effectiveness, or inspect test suites for over-mocking. Triggers automatic rewrites when quality gates fail.

QBall-Inc/the-bulwark · 0 tokens

coverage-check

Run the repo's unit tests with coverage and verify that every file touched in the current change keeps line, branch, and function coverage at or above 95%. Language- and framework-agnostic. Use before committing, before PR creation, or when the user asks about coverage.

theam/claude-dev-kit · 59 tokens

pocket-planning

Converts a pocket-grinding spec into a TDD-structured execution plan of full Pocket Packets. Use when pocket-grinding handoff arrives (spec path + acceptance criteria). Trigger on "create plan", "build plan", "pocket-planning", or when pocket-grinding skill invokes this. Outputs tasks ready to dispatch via…

rfxlamia/pocketto · 76 tokens