Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/KtKID/x-dev-pipelinenpx agentmods add skills/ktkid/x-dev-pipeline/x-qa-gateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate)<a href="https://agentmods.dev/skills/ktkid/x-dev-pipeline/x-qa-gate"><img src="https://agentmods.dev/badge/skills/ktkid/x-dev-pipeline/x-qa-gate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.01147 |
| Opus 5 | $0.00034 | $0.00574 |
| Sonnet 5 | $0.00014 | $0.00229 |
| Haiku 4.5 | $0.00007 | $0.00115 |
Grade A, and why
x-qa-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x-qa-gate · Gate ②
路由
读取 README 唯一的 risk: 字段:Q2 使用 RC;Q3 使用 R1→R2→R3;Q0/Q1 被显式调用时按 Q2 处理并在回执说明。Gate ① verify exit 0 是进入条件。
事实源
- 用户原始请求、已确认 spec、既有公开契约。
- 真实调用方、schema/数据约束、改动前测试契约。
- README 的需求要点、验收、架构拆分策略、技术设计与 dev-checklist。
- dev-report verify 块、verify JSON 或失败报告、当前 diff。
输入裁剪
| Reviewer | 必读输入 |
|---|---|
| RC | diff + README 验收/架构拆分策略 + dev-report |
| R1 | diff + README 需求要点/验收 |
| R2 | diff + README 技术设计/架构拆分策略 |
| R3 | diff + dev-report verify 块 + 测试文件 |
主 agent 提供文件路径、节名、git diff --stat、git diff --name-only 和按需 diff 命令。reviewer 按需读取源代码与测试文件。
Review 纪律
- RC 一轮覆盖契约、边界、测试真实性;Q3 严格串行 R1、R2、R3。
- 每个 reviewer 独立、只读,只返回 review 回执;x-fix 负责改动。
- 每轮穷尽检查范围后一次返回全部问题候选,并声明“已检查范围内无其他 P0/P1”。
- 每条候选固定提供
task、severity、loc、msg;task可为T2,T3,severity为 P0/P1/P2,loc为file:line,msg为单条问题描述。 - reviewer 省略 issue ID。主 agent 调用
flag后使用其 JSONissue字段建立编号映射。 - P0 需要位置与可复现依据;证据不完整时降级。P0 或未处置 P1 使本轮 fail;P2 登记且保持非阻塞。
issue 登记
主 agent 按 reviewer 返回顺序逐条执行:
python3 tools/xdev.py flag <task-dir> --task T2,T3 --severity P0 \
--loc src/a.py:10 --msg "空输入未处理" [--new-round] --json
- 本轮第一条候选添加
--new-round;后续候选追加到同一 ledger。 - 保存 JSON 返回的
issue、downgraded、report、recovered,把 issue ID 回填到交给 x-fix 的问题映射。 recovered:true表示命令完成了上一笔 pending 事务;主 agent 使用原参数再次调用,完成本条候选登记。flag是 issue ledger 与 P0/P1 checklist 降级的唯一写入口。reviewer、子 agent 与 x-fix 保持这两处原样。- 本轮无问题时省略 ledger 创建,直接进入 Gate pass 回执。
回流
本轮存在 P0/P1 时,主 agent 把带 issue-<n> 的完整问题映射交给 x-fix gate-fix。修复后复审对应 issue 与 fix diff;fix 扩大到新文件时纳入新文件,公开 API 签名变化时重做相关契约对照。reports/.fix-counter 是 verify 与 qa-gate 共享的批量修复轮数,保留三轮上限;Gate ② 最终 pass 写回 0。
Prompt 模板
Agent({
description: "<RC/R1/R2/R3> review round <N>",
subagent_type: "general-purpose",
prompt: <对应 reference + task root + 输入裁剪表指定路径/节 + diff 命令 + 输出格式>
})
回执与状态
问题 ledger 由 flag 写入 reports/qa-gate/qa-gate-report-<timestamp>[-NN].md。通过时输出:
🛡️ Gate② ✅ · <task> · Q2 RC / Q3 R1→R2→R3 · P0 ×0 · P1 ×0
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 78 lines · 69 tokens per session scan A 159b66cab6c3
x-qa-gate is a skill published in the GitHub repository KtKID/x-dev-pipeline (12 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 1,147 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
procoder
Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…
goal-test
A local experiment for testing a goal command that keeps an AI coding session working until a stated condition is judged complete. It uses a separate language model to evaluate the conversation after each assistant turn.
loop-test
A local experiment for designing repeating checks with Claude Code’s loop command. It covers both fixed intervals and checks that schedule themselves again after each run.
test-audit
Audit test suites for T1-T4 violations using AST analysis, mock detection, and multi-stage synthesis. Invoke when user asks to audit tests, check test quality, find mock violations, review test effectiveness, or inspect test suites for over-mocking. Triggers automatic rewrites when quality gates fail.
coverage-check
Run the repo's unit tests with coverage and verify that every file touched in the current change keeps line, branch, and function coverage at or above 95%. Language- and framework-agnostic. Use before committing, before PR creation, or when the user asks about coverage.
pocket-planning
Converts a pocket-grinding spec into a TDD-structured execution plan of full Pocket Packets. Use when pocket-grinding handoff arrives (spec path + acceptance criteria). Trigger on "create plan", "build plan", "pocket-planning", or when pocket-grinding skill invokes this. Outputs tasks ready to dispatch via…