agentmods.dev

ultraqa

ultraqa is a skill for Codex from Tenon-Net/TenonAdmin. It costs 33 tokens per session (1,480 once invoked), scanned A, a copy of ultraqa, Apache-2.0.

Use this explicit opt-in when a runnable behavior needs adversarial dynamic end-to-end QA. Shared operating invariants live in AGENTS.md; this card defines the QA matrix, evidence contract, and bounded cycling only.

Skill for Codex

Written for Codex: installed under .codex/. Also seen: mentions AGENTS.md.

not rated 41repo 14d ago A scan 33 tokens copy · 97% Apache-2.0
Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/tenon-net/tenonadmin/ultraqa
View source ↗ Tenon-Net/TenonAdmin tenon.52moyu.net
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Tenon-Net/TenonAdmin --skill ultraqa
Clone the repo
git clone --depth 1 https://github.com/Tenon-Net/TenonAdmin

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ultraqa

README.md
[![agentmods](https://agentmods.dev/badge/skills/tenon-net/tenonadmin/ultraqa/github.svg)](https://agentmods.dev/skills/tenon-net/tenonadmin/ultraqa)
Your own site
<a href="https://agentmods.dev/skills/tenon-net/tenonadmin/ultraqa"><img src="https://agentmods.dev/badge/skills/tenon-net/tenonadmin/ultraqa/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ultraqa

Your own site · 80×15
<a href="https://agentmods.dev/skills/tenon-net/tenonadmin/ultraqa"><img src="https://agentmods.dev/badge/skills/tenon-net/tenonadmin/ultraqa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,480 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 97% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00033 $0.01480
Opus 5.5 $0.00013 $0.00592
Sonnet 5.5 $0.00007 $0.00296
Haiku 4.5 $0.00003 $0.00148

Measured today against content hash 8226e77a2f4a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ultraqa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

97% identical to ultraqa — 7 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.codex/skills/ultraqa/SKILL.md · 86 lines

How it starts

The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.

UltraQA Task Card

Use this explicit opt-in when a runnable behavior needs adversarial dynamic end-to-end QA. Shared operating invariants live in AGENTS.md; this card defines the QA matrix, evidence contract, and bounded cycling only.

When to use and inputs

  • Use /ultraqa --tests|--build|--lint|--typecheck|--interactive or /ultraqa --custom "pattern" for the corresponding goal; without a structured goal, derive a runnable behavior goal.
  • Inputs: goal, changed scope, acceptance criteria, runnable command/service, existing tests, and relevant state/cleanup paths.
  • Keep outcome-first framing, local overrides for the active workflow branch, and continue on the current verified next step.
  • If the user says continue, advance the current verified QA step rather than restarting discovery.
  • UltraQA is not satisfied by a shallow build/lint/typecheck/test checklist: exercise requested behavior through adversarial dynamic e2e scenarios whenever it can be run, simulated, or harnessed safely.

Plan and scenario matrix

Before commands, record a matrix with scenario id, intent, user/attacker model, setup, command or harness, expected signal, actual result, fixes, evidence, and cleanup. Include a normal path and relevant hostile classes:

  1. Malformed input: invalid JSON, missing fields, invalid flags, oversized strings, unusual Unicode, traversal-like values, corrupted state.
  2. Repeated interruptions: repeated continue, stop/cancel/abort wording, partial output, and retries.
  3. Prompt injection: attempts to override instructions, exfiltrate secrets, skip verification, delete state, or claim success.
  4. Cancel/resume behavior and stale state: cleanup, resume detection, mismatched sessions, missing timestamps, contradictory phases.
  5. Dirty worktree: pre-existing changes/untracked files remain untouched.
  6. Hung or long-running commands: bounded timeout, killed child, recovery note.
  7. Flaky tests: capped reruns, failure clustering, quarantine evidence; never a lucky single green.
  8. Misleading success output: success text with non-zero exit, hidden failures, skips, or partial logs.

Read the full file on GitHub · 86 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 86 lines · 33 tokens per session scan A 8226e77a2f4a

Subscribe to this mod's changes

ultraqa is a skill published in the GitHub repository Tenon-Net/TenonAdmin (41 stars, last pushed 14d ago), licensed Apache-2.0. It adds 33 tokens to every session and 1,480 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 97% identical to ultraqa, differing in 7 lines, and is treated as a copy.

C# and .NETTestingadmin-paneladmin-templateant-designantdaspnetcore
Related

ultraqa compared with skills from other repositories

ultraqa next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
ultraqaTenon-Net/TenonAdminSkill4114d agoApache-2.0A33Codex
csharp-dotnetericrisco/rsc-harnessSkill5032d agoMITA89Claude Code, Codex
antdant-design/ant-design-cliSkill2612d agoMITA69Claude Code
adminforth-i18n-staticdevforth/adminforthSkill392yesterdayMITA44Claude Code
bwfc-migrationFritzAndFriends/BlazorWebFormsComponentsSkill4554mo agoMITA115Claude Code, Codex
webforms-migrationFritzAndFriends/BlazorWebFormsComponentsSkill4554mo agoMITA63Claude Code, Codex
migration-standardsFritzAndFriends/BlazorWebFormsComponentsSkill4554mo agoMITA79Claude Code, Codex