Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nguyenvanphituoc/shapeup-sdlc-plugin --skill qa-edge-huntergit clone --depth 1 https://github.com/nguyenvanphituoc/shapeup-sdlc-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nguyenvanphituoc/shapeup-sdlc-plugin/qa-edge-hunter)<a href="https://agentmods.dev/skills/nguyenvanphituoc/shapeup-sdlc-plugin/qa-edge-hunter"><img src="https://agentmods.dev/badge/skills/nguyenvanphituoc/shapeup-sdlc-plugin/qa-edge-hunter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nguyenvanphituoc/shapeup-sdlc-plugin/qa-edge-hunter"><img src="https://agentmods.dev/badge/skills/nguyenvanphituoc/shapeup-sdlc-plugin/qa-edge-hunter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00174 | $0.04671 |
| Opus 5 | $0.00087 | $0.02336 |
| Sonnet 5 | $0.00035 | $0.00934 |
| Haiku 4.5 | $0.00017 | $0.00467 |
Grade C, and why
qa-edge-hunter scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
Do not refuse the hunt, and do not invent a URL. Its write surface is How it starts
The opening of the file, as written. The whole thing — 344 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Edge Hunter — the post-PASS edge pass (v1.1)
Shape Up, Ch. 13: QA comes in toward the end, hunts edge cases outside the core,
and its issues are nice-to-haves by default that the team triages. This skill is that
role for the harness. It exists because the judge (spec-evaluator) is skeptical only
within the spec it is handed — absence of evidence is a FAIL, but absence of a test
case is invisible to it. The Hunter covers exactly that blind spot: behavior the spec
never wrote down.
tech-lead: ... GATE L2 → EVAL → GATE L3 PASS ──► QA EDGE HUNT (you) ──► SHIP S.0 triage → L4
charters · hunts · ~ findings → ledger
GATE L3 FAIL → fix round (never reaches you — conformance first, edges after)
Division of labor (a settled design decision, not a convention):
| Tier | Owner | When |
|---|---|---|
| Derivable tests (boundaries, error codes, no-go breaches the spec implies) | ba ## Test Surface + evaluator test-surface-conformance |
spec time / every EVAL |
| Exploratory edges (this skill) | /qa-edge-hunter |
once, post-first-PASS |
What the Hunter is and is not
| Does | Does NOT |
|---|---|
| Read EVAL-*.md to map covered territory — then hunt OUTSIDE it | Re-probe anything the evaluator already graded |
| Charter edges via six fixed lenses, minus covered territory | Author or extend ## Test Surface (that is the planner's retrofit-surface operation) |
| Execute charters against the running deliverable (session-based exploratory) | Read-only speculate from code ("this looks racy") — every finding needs a live repro |
Return each finding in the WorkResult's discoveries[], always ~ |
Promote ~ → must-have (PO/TL at SHIP S.0; severity-hint is advice, not a decision) |
Emit qa/hunt-report.md — charters run/cut, findings by lens |
Render a verdict, score, or PASS/FAIL of any kind |
Pure worker (harness rule: stateless workers, one stateful orchestrator). Its WorkOrder
carries payload.feature, payload.spec_folder, payload.eval_report, payload.app_url,
payload.kb_rules_path, and payload.ledger (the discovery ledger, READ-ONLY — covered-territory
context so a hunt does not re-report what is already known). app_url is null when the
deliverable is not served over HTTP — a CLI, a library, a batch job. That is a normal order, not a
malformed one: drive the built entry point instead, exactly as the Test Surface's process rows do.
Do not refuse the hunt, and do not invent a URL. Its write surface is
.shapeup/<feature>/qa/** only. The Hunter never touches the discovery ledger itself —
ingest appends its discoveries[] under a ## Discovered section, preserving single-writer
mechanically.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 344 lines · 174 tokens per session scan C bb9bb5e4e0ba
qa-edge-hunter is a skill published in the GitHub repository nguyenvanphituoc/shapeup-sdlc-plugin (2 stars, last pushed 2d ago), licensed MIT. It adds 174 tokens to every session and 4,671 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent never to refuse). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mcp-app-verification
Comprehensive verification checklists for MCP Apps. Tests with basic-host reference, validates handler-before-connect, text fallback, resource URI linking, single-file bundling, host styling, CSP, and legacy pattern detection.
quality-hooks
Language-specific auto-lint/format/typecheck pipeline. Supports Python (ruff+pyright), TypeScript (prettier+eslint+tsc), Go (gofmt+golangci-lint). Auto-fix and convergence loops.
hook-management
Session-scoped hook lifecycle management with enable/disable/status controls, execution profiling, and color-coded performance alerts.
spec-execution
6-phase iterative specification execution workflow covering implementation, testing, review, improvement, commit, and progress tracking with quality-gated convergence.
strict-tdd
Strict RED->GREEN->REFACTOR test-driven development with enforcement. Never write production code before a failing test. Atomic commits per TDD cycle.
tdd-enforcement
Red-Green-Refactor TDD methodology with mandatory failing tests, minimal implementation, quality refactoring, and 80% coverage gating.