A bug-fixing workflow that turns tracker issues marked by a human as real bugs into tested merge requests. A merge request is a proposed change for review and merging.

Use it to process labelled GitHub or GitLab issues, create regression tests, run the test suite, open linked merge requests, and have an independent check of each fix.

It removes the repeated work of reproducing confirmed bugs, adding regression tests, fixing the code, and checking the fix.

qa-fix — Skill for Claude Code by victoraguilarsantamariadev

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code

/plugin marketplace add victoraguilarsantamariadev/qa-explore

Claude Code

/plugin install qa-explore

Made for: Claude Code.

Or install qa-explore, the plugin that ships this one along with the rest of its 6 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/victoraguilarsantamariadev/qa-explore/qa-fix/github.svg)](https://agentmods.dev/skills/victoraguilarsantamariadev/qa-explore/qa-fix)

Your own site

<a href="https://agentmods.dev/skills/victoraguilarsantamariadev/qa-explore/qa-fix"><img src="https://agentmods.dev/badge/skills/victoraguilarsantamariadev/qa-explore/qa-fix/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/victoraguilarsantamariadev/qa-explore/qa-fix"><img src="https://agentmods.dev/badge/skills/victoraguilarsantamariadev/qa-explore/qa-fix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 118 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,771 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00118	$0.01771
Opus 5	$0.00059	$0.00886
Sonnet 5	$0.00024	$0.00354
Haiku 4.5	$0.00012	$0.00177

Measured 9d ago against content hash 22f3f1daeac4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

qa-fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (engine/qa-fix.workflow.js), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/qa-fix/SKILL.md · 59 lines

How it starts

The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.

qa-fix

The fixing half of the closed loop. qa-explore files issues for what it finds; a human marks the real ones with the fix label; qa-fix turns those labelled issues into reviewed merge requests.

qa-explore  →  files issue per confirmed finding
human       →  adds the fix label to the genuine bugs        ← the triage gate
qa-fix Fix  →  per labelled issue, in an isolated worktree:
               reproduce → write RED regression test (run against the CHANGED code) → fix
               → test GREEN + suite green → push branch → open MR ("Closes #iid")
qa-fix Verify → an INDEPENDENT skeptic checks out the branch: audits the test, confirms
               red-without-fix / green-with-fix, reproduces the bug is gone, reviews the diff
               → comments its verdict on the MR (qa::fix-verified | qa::fix-doubt)
human       →  reviews & merges the MR                        ← the merge gate

Two human gates, both lightweight, both in the tracker: which bugs get fixed (the label) and what actually ships (the merge). qa-fix never merges and never touches an unlabelled issue. The fix is checked twice: deterministically (its own regression test + suite) and by an independent agent (the Verify-fix pass) — the same adversarial idea as explore→verify, now for fixes.

Engine (invoke via the Workflow tool; do not inline)

${CLAUDE_PLUGIN_ROOT}/skills/qa-fix/engine/qa-fix.workflow.js

(If $CLAUDE_PLUGIN_ROOT is unset, the skill is at ~/.claude/skills/qa-fix — resolve the engine path relative to this SKILL.md.)

Prerequisites

A qa.config.json with a tracker block (type = gitlab | github, host, project, tokenEnv, fixLabel, fixingLabel, defaultBranch) and a fix block. Same file qa-explore uses.
The token: a Personal Access Token with api scope (GitLab) exported in the env var named by tracker.tokenEnv (e.g. GITLAB_TOKEN). Confirm it is set before running — never inline or echo it.
Run this skill from inside the target project's git repo — each agent works in a git worktree of the current repo, and pushes a branch to its origin. Push access (SSH/PAT) must already work.
fix.buildTest (a code-level test command) and/or fix.localRun (how to build + serve the fixed app locally) so the regression test runs against the changed code, not the stale live app. Without either, the agent falls back to building/serving from the worktree itself — slower and less reliable. See the Notes.

Read the full file on GitHub · 59 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

engine/qa-fix.workflow.js 22 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 59 lines · 118 tokens per session scan A 22f3f1daeac4

Subscribe to this mod's changes

qa-fix is a skill published in the GitHub repository victoraguilarsantamariadev/qa-explore (2 stars, last pushed 1mo ago), licensed MIT. It adds 118 tokens to every session and 1,771 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Debugging Testing accessibility ai-agents claude-code-plugin playwright

cypress-debugger

Use when a Cypress end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Cypress spec, Timed-out-retrying command, unresolved selector, cy.intercept alias or request race, suite-breaking hook, retry-only flake, hydration or timing race, or a…

voidmatcha/e2e-skills · 158 tokens

playwright-debugger

Use when a Playwright end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Playwright spec, TimeoutError, broken or ambiguous selector, post-deploy suite failure, retry-only flake, hydration or timing race, or a passes-locally-but-fails-in-CI split.…

voidmatcha/e2e-skills · 163 tokens

sniff

Use when the user types /sniff, or asks to "scan this project for bugs", "find bugs in my app", "QA my site", or "walk my app and tell me what's broken". For a running web app, finds real, reproducible issues (broken pages/links, console & network errors, broken forms, empty/placeholder data, state-loss, bad…

Aboudjem/sniff · 107 tokens

sniff-fix

Scan the project and auto-fix safe issues (remove debugger statements, console.log calls, and other auto-fixable problems).

Aboudjem/sniff · 31 tokens

generate-a11y-tests

Generates comprehensive Playwright accessibility tests with axe-core integration for any UI component or page. Use this skill to create automated accessibility regression tests that verify WCAG 2.1 Level AA compliance.\n\n \nContext: Developer has just completed building a login form component.\nuser: \"Generate…

deepakkamboj/claude-marketplace · 417 tokens

verify

Verify Elixir/Phoenix changes — compile, format, and test in one loop. Use after implementation, before PRs, or after fixing bugs.

oliver-kriska/claude-elixir-phoenix · 33 tokens

qa-fix

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

qa-fix

Engine (invoke via the Workflow tool; do not inline)

Prerequisites

What ships with it

What this file has done since we first saw it

Other skills, from other repositories

cypress-debugger

playwright-debugger

sniff

sniff-fix

generate-a11y-tests

verify