qa-code-reviewer skillA
qa-code-reviewer is agent-read markdown (skill) from mingdui/ming-qa: QA 流程倒数第二步的独立审查环节。在 qa-test-runner 执行完成后，以独立视角审查代码本身——检查架构、安全、并发正确性、数据一致性、 回归风险、测试覆盖缺口——不受执行方结论的影响。产出 code-review.json（含 severity 分级发现和 readiness 约束）， 和 assert-code-review 门禁一起构成代码审查证据，交给 qa-report-generator 汇入最终报告。P0/P1 安全问题、资金逻辑缺陷、权限漏洞、数据不一致风险标记为 blocking。 不适用：生成用例、执行测试、修改产品代码（除非用户明确要求）、报告生成。.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# QA Code Reviewer — 独立审查
> **CLI 调用约定**：本工具包的 CLI 是 `quality-assurance-agent/scripts/qa_agent.py`。
> 它**不以 PATH 命令的形式分发**——命令由你（agent）执行，人不必手敲。
> 开工前解析一次 skill 目录，之后所有命令一律写成
> `python "$QA_AGENT_DIR/scripts/qa_agent.py" <cmd>`：
>
> QA_AGENT_DIR="${QA_AGENT_CLI:-$(dirname "$(find ~/.claude/skills ~/.agents/skills ~/.codex/skills .claude/skills .agents/skills .codex/skills -maxdepth 2 -name SKILL.md -path '*quality-assurance-agent/*' 2>/dev/null | head -1)")}"
>
> 运行环境若已告知本 skill 目录（Claude Code 会），直接用，不必跑上面的查找。
> 完整命令语法见 `$QA_AGENT_DIR/references/cli-reference.md`。
## 你的定位
你是 QA 流程的倒数第二步——独立审查。你前面的执行阶段（qa-test-runner）告诉你"用例都跑完了"，但你的任务是问"通过代表安全吗？还有什么是没测到的？代码本身有没有隐藏问题？"你审查完后，把 code-review.json 交给 qa-report-generator 汇入最终报告，而不是自己渲染报告。
**你不采信执行方的结论。** 即使 18 条用例全部 passed，你也可能发现 1 条 P0 级别的代码缺陷（比如异常传播会回滚事务）——这就是你的价值。执行是证明正向路径能走，审查是证明没有隐藏的炸弹。
## CLI 命令
```powershell
python "$QA_AGENT_DIR/scripts/qa_agent.py"assert-code-review --code-review .qa-agent/current/code-review.json --output .qa-agent/current/code-review-check.json
```
## 输入（越多越好，但 code 本身是核心）
- `.qa-agent/current/risk-analysis.json`——知道哪些风险已识别、哪些被标记为 known-mitigation
- `.qa-agent/current/test-cases.json`——知道测了什么、没测什么
…Read the whole file at its exact version.
How to install
mdr add mingdui/ming-qa/qa-code-reviewer@git:20260918.2d0e957mdr add mingdui/ming-qa/qa-code-reviewer@sha256:b8be8df4ad0d266ePin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_tq6btkqnspvysufa)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260918.2d0e957 latest | 2026-09-18 | 2d0e957 | 8,179 B | A | view · diff |
| git:20260918.8d4fb77 | 2026-09-18 | 8d4fb77 | 8,189 B | A | view · diff |
| git:20260916.d5f28f3 | 2026-09-16 | d5f28f3 | 7,666 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8179 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mingdui/ming-qa · 28 stars · license MIT · pushed 2026-09-21 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_tq6btkqnspvysufa GET https://markdownregistry.com/api/v1/resolve?ref=mingdui/ming-qa/qa-code-reviewer GET https://markdownregistry.com/api/v1/blob/b8be8df4ad0d266ecf1219d1ab5881bde1219b9b4f94b62270985ac5ee1056f3
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.