registry / qaa-agent / 1.9.6

qaa-agent@1.9.6

QA Automation Agent for Claude Code — multi-agent pipeline that analyzes repos, generates tests, validates, and creates PRs

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 16 file(s), 287 KB of source, external domains: api.search.brave.com

Source & flagged code

9 flagged

agents/qaa-analyzer.mdView file

Lines 251-291markdown

251| unit_count + unit_percent | Count and percentage (target 60-70%) |

252| integration_count + integration_percent | Count and percentage (target 10-15%) |

253| api_count + api_percent | Count and percentage (target 20-25%) |

254| e2e_count + e2e_percent | Count and percentage (target 3-5%) |

255| p0_count | Number of P0 tests |

256| p1_count | Number of P1 tests |

257| p2_count | Number of P2 tests |

258| coverage_narrative | 2-3 sentences: what this inventory covers and any known gaps |

259

260Summary counts MUST match the actual test case counts in each section below.

261

262**Section 2: Unit Tests (target 60-70%)**

263

264For EVERY unit test case, ALL 7 fields are MANDATORY:

265

266| Field | Format | Rule |

267|-------|--------|------|

268| test_id | UT-MODULE-NNN | Unique across entire document |

269| target | file_path:function_name | Specific function, not just a file |

270| what_to_validate | One sentence | Clear behavior description |

271| concrete_inputs | Actual values | NOT "valid data" or "correct input" -- use real values like `{email: 'test@example.com', password: 'SecureP@ss123!'}` |

Medium

Secret Pattern

Hardcoded password in agents/qaa-analyzer.md

agents/qaa-analyzer.mdView on unpkg · L271

272| mocks_needed | List or "None (pure function)" | Dependencies to mock |

273| expected_outcome | Exact value/error/state | NOT "returns correct data" -- use exact values like `Returns 239.47` or `Throws InvalidTransitionError with message 'Cannot transition from delivered to pending'` |

274| priority | P0, P1, or P2 | P0 = blocks release, P1 = should fix, P2 = nice to have |

275

276Group unit tests by module with clear section headers. Include both happy-path and error cases for critical modules (auth, payments, orders -- minimum 1 success + 1 failure per function).

277

278Match test targets to the Top 10 Unit Test Targets from QA_ANALYSIS.md.

279

280**Section 3: Integration/Contract Tests (target 10-15%)**

281

282For each test case, ALL fields mandatory:

283- test_id: INT-MODULE-NNN

284- components_involved: Which modules interact

285- what_to_validate: The interaction contract being tested

286- setup_required: Database state, mock services, or seed data needed

287- expected_outcome: Specific behavior when components interact correctly

288- priority: P0, P1, or P2

289

290Focus on: database interactions, service-to-service calls, cross-module state flows.

291

agents/qaa-executor.mdView file

Lines 479-531markdown

479 - Import the API client or use framework's request helper

480 - Set up base URL from environment variable: `const baseUrl = process.env.API_URL || 'http://localhost:3000'`

481 - Group test cases by endpoint using `describe` blocks

482 - For each test case (API-RESOURCE-NNN):

483 - Create a `describe` block for the endpoint (e.g.,

templates/test-inventory.mdView file

Lines 193-241markdown

193- **Target:** `src/utils/priceCalculator.ts:calculateOrderTotal`

194- **What to validate:** Returns 0 for empty cart

195- **Concrete inputs:** `[]`

196- **Mocks needed:** None (pure function)

197- **Expected outcome:**

templates/qa-audit-report.mdView file

Lines 302-342markdown

302| Test Coverage | 80 | B | 20% | 16.00 | Auth and Products well covered; Orders, Payments, Inventory have zero tests |

303| Naming Convention | 65 | D | 15% | 9.75 | 3 files do not follow naming pattern; 4 test IDs use non-standard format |

304| Test Data Management | 60 | D | 10% | 6.00 | 2 hardcoded emails found; no .env.example or .env.test file exists |

305

306**Overall Score Calculation:**

307```

308Overall = (45 * 0.20) + (70 * 0.20) + (55 * 0.15) + (80 * 0.20) + (65 * 0.15) + (60 * 0.10)

309 = 9.00 + 14.00 + 8.25 + 16.00 + 9.75 + 6.00

310 = 63.00

311```

Source & flagged code

9 flagged · loading source

agents/qaa-analyzer.mdView file

271patternName = generic_password severity = medium line = 271 matchedText = | concre...}` |

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code