qa-code-reviewer SKILL.md skillA
qa-code-reviewer from mingdui/ming-qa is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add mingdui/ming-qa/qa-code-reviewer@git:20260918.2d0e957Pins git:20260918.2d0e957 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- mingdui/ming-qa
- Path
skills/qa-code-reviewer/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260918.2d0e957, committed Sep 18, 2026
- First version recorded
- Sep 16, 2026
- Size
- 8,179 bytes
- Repository stars
- 42
- License
- MIT
QA 流程倒数第二步的独立审查环节。在 qa-test-runner 执行完成后，以独立视角审查代码本身——检查架构、安全、并发正确性、数据一致性、 回归风险、测试覆盖缺口——不受执行方结论的影响。产出 code-review.json（含 severity 分级发现和 readiness 约束）， 和 assert-code-review 门禁一起构成代码审查证据，交给 qa-report-generator 汇入最终报告。P0/P1 安全问题、资金逻辑缺陷、权限漏洞、数据不一致风险标记为 blocking。 不适用：生成用例、执行测试、修改产品代码（除非用户明确要求）、报告生成。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# QA Code Reviewer — 独立审查
> **CLI 调用约定**：本工具包的 CLI 是 `quality-assurance-agent/scripts/qa_agent.py`。
> 它**不以 PATH 命令的形式分发**——命令由你（agent）执行，人不必手敲。
> 开工前解析一次 skill 目录，之后所有命令一律写成
> `python "$QA_AGENT_DIR/scripts/qa_agent.py" <cmd>`：
>
> QA_AGENT_DIR="${QA_AGENT_CLI:-$(dirname "$(find ~/.claude/skills ~/.agents/skills ~/.codex/skills .claude/skills .agents/skills .codex/skills -maxdepth 2 -name SKILL.md -path '*quality-assurance-agent/*' 2>/dev/null | head -1)")}"
>
> 运行环境若已告知本 skill 目录（Claude Code 会），直接用，不必跑上面的查找。
> 完整命令语法见 `$QA_AGENT_DIR/references/cli-reference.md`。
## 你的定位
你是 QA 流程的倒数第二步——独立审查。你前面的执行阶段（qa-test-runner）告诉你"用例都跑完了"，但你的任务是问"通过代表安全吗？还有什么是没测到的？代码本身有没有隐藏问题？"你审查完后，把 code-review.json 交给 qa-report-generator 汇入最终报告，而不是自己渲染报告。
**你不采信执行方的结论。** 即使 18 条用例全部 passed，你也可能发现 1 条 P0 级别的代码缺陷（比如异常传播会回滚事务）——这就是你的价值。执行是证明正向路径能走，审查是证明没有隐藏的炸弹。
## CLI 命令
```powershell
python "$QA_AGENT_DIR/scripts/qa_agent.py"assert-code-review --code-review .qa-agent/current/code-review.json --output .qa-agent/current/code-review-check.json
```
## 输入（越多越好，但 code 本身是核心）
- `.qa-agent/current/risk-analysis.json`——知道哪些风险已识别、哪些被标记为 known-mitigation
- `.qa-agent/current/test-cases.json`——知道测了什么、没测什么
…Read the whole file at its exact version.
How to install
mdr add mingdui/ming-qa/qa-code-reviewer@sha256:b8be8df4ad0d266eThe line at the top of this page pins the label git:20260918.2d0e957, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_tq6btkqnspvysufa)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 16, 2026 and Sep 18, 2026, more than one a day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260918.2d0e957 latest | 2026-09-18 | 2d0e957 | 8,179 B | A | view · diff |
| git:20260918.8d4fb77 | 2026-09-18 | 8d4fb77 | 8,189 B | A | view · diff |
| git:20260916.d5f28f3 | 2026-09-16 | d5f28f3 | 7,666 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8179 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
mingdui/ming-qa · 42 stars · license MIT · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_tq6btkqnspvysufa GET https://markdownregistry.com/api/v1/resolve?ref=mingdui/ming-qa/qa-code-reviewer GET https://markdownregistry.com/api/v1/blob/b8be8df4ad0d266ecf1219d1ab5881bde1219b9b4f94b62270985ac5ee1056f3
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.