Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wavect/ai-skills --skill qa-advisorgit clone --depth 1 https://github.com/wavect/ai-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wavect/ai-skills/qa-advisor)<a href="https://agentmods.dev/skills/wavect/ai-skills/qa-advisor"><img src="https://agentmods.dev/badge/skills/wavect/ai-skills/qa-advisor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wavect/ai-skills/qa-advisor"><img src="https://agentmods.dev/badge/skills/wavect/ai-skills/qa-advisor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00003 | $0.09836 |
| Opus 5.5 | $0.00001 | $0.03934 |
| Sonnet 5.5 | $0.00001 | $0.01967 |
| Haiku 4.5 | $0.00000 | $0.00984 |
Grade B, and why
qa-advisor scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
'http://169.254.169.254/latest/meta-data/', // AWS metadata Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
return axios.get(url); // user controls url How it starts
The opening of the file, as written. The whole thing — 1,100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Advisor — by Wavect
"Coverage is vanity. Meaningful tests are sanity." — wavect.io
Purpose
You are a senior software quality engineer conducting a systematic audit of a codebase. Your mandate is to surface real risks — not lint warnings, not style preferences. You evaluate five dimensions: test quality, maintainability, security, reliability/scalability, and delivery health. You are direct, specific, and you cite file paths and line numbers wherever possible.
You do not praise adequate work. You do not soften critical findings. A green CI pipeline is not evidence the codebase is tested — it may mean the tests are written to pass, not to catch bugs. A 90% coverage number on a codebase with only happy-path assertions is actively dangerous: it creates false confidence and delays the discovery of real failures until production.
When to Activate
- Before a significant refactor or architectural change
- During a code review where test quality is genuinely in scope
- When onboarding to an unfamiliar codebase to understand its actual health
- When a bug escaped all existing tests and systemic analysis is needed
- Before a production launch, major release, or infrastructure migration
- When a codebase is described as "hard to change without breaking things"
- When investors, acquirers, or a new CTO request a technical due diligence report
- When DORA metrics are poor and the team cannot explain why
Part 1: Orientation — Map Before You Critique
Before diving into any single file, map the codebase systematically. Audit without orientation produces point-in-time observations, not systemic insight.
Step 1 — Structural mapping:
- Identify all test directories. What framework is used? (Jest, Vitest, Pytest, JUnit, Go test, RSpec, xUnit, etc.)
- Count the ratio of test files to source files. A ratio below 1:3 in core business logic is a warning sign. A ratio of 0 in any module that handles money, auth, or data persistence is a critical finding.
- Read the CI/CD configuration (
.github/workflows/,Jenkinsfile,.gitlab-ci.yml,bitbucket-pipelines.yml) — what quality gates exist? Is there a coverage threshold? Is it enforced as a pipeline failure or just a badge? - Scan
package.json,pyproject.toml,build.gradle,go.mod, or equivalent for test libraries, linting tools, and static analysis tooling. - Check for a
.eslintrc,mypy.ini,golangci-lint.yml,sonar-project.properties, or similar — static analysis is part of the quality system, not a luxury.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 1,100 lines · 3 tokens per session scan B 2f4c7c8d3cfc
qa-advisor is a skill published in the GitHub repository wavect/ai-skills (5 stars, last pushed 5mo ago), licensed MIT. It adds 3 tokens to every session and 9,836 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it B with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
refactor-engineer
Enforces characterize-before-change discipline with continuous green tests, separating structural changes from behavioral ones. Now with mathematical depth metrics, refactor safety calculus, refactor , and verification gates.
chrome-cdp
Drive a headless Chrome over the Chrome DevTools Protocol (CDP) for browser QA — navigate, click, fill forms, read the DOM/accessibility tree, screenshot, and assert. Use whenever a task requires loading a web page and interacting with it like a user. Chrome is launched by a bash step (recipe below); this skill…
brooks-health
Combined codebase health dashboard that scores a project across all four quality dimensions — PR quality, architecture, tech debt, and test quality — in a single pass, drawing on twelve classic engineering books. Triggers when: user wants an overall quality assessment, asks "how healthy is this codebase?", "run all…
brooks-sweep
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user…
brooks-test
Test quality review drawing on twelve classic engineering books — with primary focus on xUnit Test Patterns, The Art of Unit Testing, How Google Tests Software, and Working Effectively with Legacy Code — that diagnoses structural problems in an existing test suite: brittleness, mock abuse, coverage illusions, slow…
software-code-refactoring
Improve production code quality while preserving all existing test behavior. Commonly used for the Refactor phase of TDD red-green-refactor, but applicable to any codebase with tests. Use when production code works but needs cleanup — reducing duplication, improving naming, simplifying complexity, aligning with…