Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ToruAI/toru-claude-agents --skill dev-qagit clone --depth 1 https://github.com/ToruAI/toru-claude-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/toruai/toru-claude-agents/dev-qa)<a href="https://agentmods.dev/skills/toruai/toru-claude-agents/dev-qa"><img src="https://agentmods.dev/badge/skills/toruai/toru-claude-agents/dev-qa.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00926 |
| Opus 5 | $0.00012 | $0.00463 |
| Sonnet 5 | $0.00005 | $0.00185 |
| Haiku 4.5 | $0.00002 | $0.00093 |
Grade A, and why
dev-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dev QA - Quality Assurance Checks
Run all quality checks: Tests → Lint → Types → Build
Philosophy
"Find bugs before they find users. Run QA early, run it often."
Flow
1. Detect Project Type
# Check what we're working with
[ -f "package.json" ] && echo "node"
[ -f "Cargo.toml" ] && echo "rust"
[ -f "pyproject.toml" ] || [ -f "requirements.txt" ] && echo "python"
[ -f "go.mod" ] && echo "go"
2. Run Checks (by project type)
Node/TypeScript
# Tests
npm test 2>&1 || yarn test 2>&1 || pnpm test 2>&1
# Lint
npm run lint 2>&1 || npx eslint . 2>&1
# Type check
npx tsc --noEmit 2>&1
# Build
npm run build 2>&1
Rust
# Tests
cargo test 2>&1
# Lint
cargo clippy -- -D warnings 2>&1
# Format check
cargo fmt --check 2>&1
# Build
cargo build 2>&1
Python
# Tests
pytest 2>&1 || python -m pytest 2>&1
# Lint
ruff check . 2>&1 || flake8 . 2>&1
# Type check
mypy . 2>&1 || pyright . 2>&1
# Format check
black --check . 2>&1 || ruff format --check . 2>&1
Go
# Tests
go test ./... 2>&1
# Lint
golangci-lint run 2>&1
# Build
go build ./... 2>&1
3. Report Results
Format output as:
## QA Report
### Tests
✓ Passed: 42
✗ Failed: 2
⊘ Skipped: 1
Failed tests:
- test_user_auth: AssertionError at line 45
- test_token_refresh: Timeout
### Lint
✓ No issues
### Type Check
⚠ 3 warnings:
- src/auth.ts:12 - Type 'any' used
- src/utils.ts:34 - Implicit return type
### Build
✓ Build successful
### Summary
Status: FAILING
Must fix: 2 test failures
Should fix: 3 type warnings
4. Next Steps
Based on results:
If all pass:
QA passed! Ready for:
- /dev-security - Security audit
- /dev-rc - Release candidate prep
- /dev-finish - Close the cycle
If failures:
QA found issues.
Options:
1. Fix now (I'll help)
2. Fix manually, run /dev-qa again
3. Continue anyway (not recommended)
If "Fix now":
- Delegate to Bob: "Fix these QA issues: {list}"
- Re-run QA after fixes
- Loop until clean
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 187 lines · 24 tokens per session scan A 8b902b1d5106
dev-qa is a skill published in the GitHub repository ToruAI/toru-claude-agents (15 stars, last pushed 1mo ago), licensed MIT. It adds 24 tokens to every session and 926 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ln-23-test-suite-auditor
Audits existing tests for meaningful coverage, trustworthy oracles, and maintenance value. Not for test implementation or a single delivery review.
ln-21-documentation-auditor
Audits documentation and comments for trustworthy claims, coverage, and discoverability. Not for code, test, or architecture audits.
ln-41-test-strategy-planner
Plans a risk-based test portfolio and prioritized scenarios without editing tests. Not for test execution or implementation.
ln-42-acceptance-test-builder
Builds, updates, consolidates, or retires scoped acceptance tests and records execution evidence. Not for product-code fixes or audits.
journey-simulation
Use when caller wants to observe how a stranger encounters a flow, artifact, or sandbox — triggers like "simulate a user journey", "test our onboarding / checkout / signup", "will my ICP convert", "how does a cold reader experience this README", "first-time user test", "cognitive walkthrough", or any request to…
kotlin-testing
Kotlin testing patterns with Kotest, MockK, coroutine testing, property-based testing, and Kover coverage. Follows TDD methodology with idiomatic Kotlin practices.