x-qa-gate

x-qa-gate is a skill for Claude Code from KtKID/x-dev-pipeline. It costs 140 tokens per session (1,344 once invoked), scanned A, original, MIT.

A quality-review gate for completed development tasks. It checks the code against the request, design, tests, verification evidence, and current changes, using different review rounds for different risk levels.

In plain words
What is it for?
Use it after automated verification to review Q2 or Q3 tasks. Reviewers list issues with locations and severity, while the x-fix process records and repairs them.
Why use it?
It helps catch contract mistakes, boundary problems, and tests that do not really prove the requested behavior before delivery.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \.

Part of the x-dev-pipeline plugin — 25 skills shipped together

Good fit Use it after automated verification to review Q2 or Q3 tasks. Reviewers list issues with locations and severity, while the x-fix process records and repairs them.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/KtKID/x-dev-pipeline
agentmods
npx agentmods add skills/ktkid/x-dev-pipeline/x-qa-gate

Made for: Claude Code.

Or install x-dev-pipeline, the plugin that ships this one along with the rest of its 25 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for x-qa-gate

README.md
[![agentmods](https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate/github.svg)](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate)
Your own site
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for x-qa-gate

Your own site · 80×15
<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 140 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,344 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00140 $0.01344
Opus 5.5 $0.00056 $0.00538
Sonnet 5.5 $0.00028 $0.00269
Haiku 4.5 $0.00014 $0.00134

Measured 1mo ago against content hash b7bc67b59581, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

x-qa-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

evals/x-pipeline-efficiency-workspace/iteration-0/eval-10-voice-chain-end-to-end/without_skill/run-1/workspace/skills/x-qa-gate/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

verify 后续质量审查

路由

verify exit 0 后进入质量审查。读取 task dev-checklist.md 头部的 risk::

  • Q0和Q1 risk串行检查 :三个 reviewer agent 并行完成 q1-intent、q2-correctness、q3-evidence。

三类审查

q1-intent

检查实现是否对齐用户意图、已确认需求、验收 Scenario、既有公开契约和声明的改动范围。

q2-correctness

检查非法输入、边界条件、失败路径、状态转换、缓存、并发、幂等性和资源清理是否正确。

q3-evidence

检查测试和 verify 证据是否真实触达改动路径,断言是否独立于实现,mock 是否保留真实契约,证据是否能击穿错误实现。

事实源

  1. 用户原始请求、已确认 spec、既有公开契约。
  2. 真实调用方、schema/数据约束、改动前测试契约。
  3. spec2 的 Requirement/Scenario、系统不变量、modules/design;或 spec3 的目标、影响边界与不变量、判断依据、建模覆盖和直接 Scenarios。
  4. dev-report verify 块、verify JSON 或失败报告、当前 diff。

输入裁剪

Reviewer 必读输入
综合 reviewer diff + task 引用的 Scenario + 相关边界/不变量 + dev-report + 测试文件
q1-intent diff + 目标/Requirement + task 引用的 Scenario
q2-correctness diff + 影响边界、不变量、建模覆盖及相关 modules/design
q3-evidence diff + dev-report verify 块 + 测试文件

主 agent 提供文件路径、节名、git diff --stat、git diff --name-only 和按需 diff 命令。reviewer 按需读取源代码与测试文件。

Review 纪律

  • 每个 reviewer 独立、只读,只返回 review 回执;x-fix 负责改动。
  • 每轮穷尽检查范围后一次返回全部问题候选,并声明“已检查范围内无其他 P0/P1”。
  • 每条候选固定提供 task、severity、loc、msg;task 可为 T2,T3,severity 为 P0/P1/P2,loc 为 file:line,msg 为单条问题描述。
  • reviewer 省略 issue ID。主 agent 调用 flag 后使用其 JSON issue 字段建立编号映射。
  • P0 需要位置与可复现依据;证据不完整时降级。P0 或未处置 P1 使本轮 fail;P2 登记且保持非阻塞。

issue 登记

主 agent 按 reviewer 返回顺序逐条执行:

python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \
    --loc src/a.py:10 --msg "空输入未处理" [--new-round] --json
  1. 本轮第一条候选添加 --new-round;后续候选追加到同一 ledger。
  2. 保存 JSON 返回的 issue、downgraded、report、recovered,把 issue ID 回填到交给 x-fix 的问题映射。
  3. recovered:true 表示命令完成了上一笔 pending 事务;主 agent 使用原参数再次调用,完成本条候选登记。
  4. flag 是 issue ledger 与 P0/P1 checklist 降级的唯一写入口。reviewer、子 agent 与 x-fix 保持这两处原样。
  5. 本轮无问题时省略 ledger 创建,直接输出通过回执。

回流

本轮存在 P0/P1 时,主 agent 把带 issue-<n> 的完整问题映射交给 x-fix 批量修复。修复后复审对应 issue 与 fix diff;fix 扩大到新文件时纳入新文件,公开 API 签名变化时重做相关意图和契约对照。reports/.fix-counter 记录 verify 与质量审查共享的批量修复轮数,保留三轮上限;质量审查最终通过后写回 0。

Read the full file on GitHub · 93 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +15 lines · +71 tokens per session b7bc67b59581
  2. 2mo ago First seen · 78 lines · 69 tokens per session scan A 159b66cab6c3

Subscribe to this mod's changes

x-qa-gate is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 17d ago), licensed MIT. It adds 140 tokens to every session and 1,344 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

test-audit

Audit test suites for T1-T4 violations using AST analysis, mock detection, and multi-stage synthesis. Invoke when user asks to audit tests, check test quality, find mock violations, review test effectiveness, or inspect test suites for over-mocking. Triggers automatic rewrites when quality gates fail.

QBall-Inc/the-bulwark · 0 tokens

holdout-validation

Cross-reference agent self-review claims and evidence-bundle entries against actual file state using hidden holdout scenarios, producing P1/P2/P3 findings mapped to visible acceptance criteria only. Checks that every expected value in the tests has the source the bundle claims and that every risk-map row has a…

synaptiai/synapti-marketplace · 130 tokens

review

Holistic review of all changes — correctness, consistency, style, test coverage. Runs tests, checks console, verifies integration. Returns pass/fail report.

gosha70/code-copilot-team · 33 tokens

pocket-planning

Converts a pocket-grinding spec into a TDD-structured execution plan of full Pocket Packets. Use when pocket-grinding handoff arrives (spec path + acceptance criteria). Trigger on "create plan", "build plan", "pocket-planning", or when pocket-grinding skill invokes this. Outputs tasks ready to dispatch via…

rfxlamia/pocketto · 76 tokens

validate-plan

Validate implementation plans against DRY, YAGNI, TDD principles and best practices. Use when reviewing plans from pocket-planning or another planning workflow to identify gaps, anti-patterns, and improvement opportunities before execution.

rfxlamia/pocketto · 47 tokens

coding-standards

Quality gates, prohibited patterns, verification discipline, and self-audit rules for all code generation and review sessions.

gosha70/code-copilot-team · 27 tokens