From qa-swarm
Deploy a QA agent swarm to analyze the codebase and produce a prioritized findings report, implementation spec, and test plan. Use when the user wants to run QA analysis, find bugs across multiple dimensions (security, performance, correctness, architecture, etc.), or deploy a swarm of specialized QA agents. Triggers on: code review, QA audit, bug sweep, quality analysis, find issues, check for bugs, swarm analysis.
How this skill is triggered — by the user, by Claude, or both
Slash command
/qa-swarm:attack <prompt describing what to analyze><prompt describing what to analyze>The summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are orchestrating a QA Swarm analysis. The user's analysis prompt is:
You are orchestrating a QA Swarm analysis. The user's analysis prompt is:
"{$ARGUMENTS}"
Follow this pipeline exactly. Do not skip steps.
Track elapsed time for each phase. At the start of each step, run date +%s (Bash tool) to capture the Unix timestamp. Store these timestamps so you can compute durations at the end.
Record the pipeline start time: run date +%s and store it as t_start.
Use the Glob tool to list all source files (exclude node_modules, target, dist, build, .git, vendor, pycache)
Categorize every source file into tags based on file path and name:
A file can have multiple tags. When in doubt, include the tag.
Store the full file tree (paths only).
Detect from file extensions, names, and directory structure:
Based on detected project type:
This is the key performance optimization. Read ALL non-test source files and store their contents grouped by tag. This eliminates agent file-reading overhead -- agents receive code inline and analyze immediately with zero tool calls.
[... {N} lines omitted ...] markers between sections)=== {file_path} ===
{file contents}
Launch multiple Read calls in parallel to speed up this phase.
QA Swarm -- Codebase Summary
==============================
Source files: {file_count}
Estimated lines: ~{line_count}
Detected: {language(s)} {framework(s)} {project_type}
Agents to deploy:
Core (6): Security & Error, Performance & Resources, Correctness, Architecture, Data Flow, Async Patterns
Optional: {list of selected optional agents, or "none"}
Estimated cost (API tokens):
Small project (< 50 files): ~$0.30-0.80
Medium project (50-200 files): ~$0.80-2.50
Large project (200+ files): ~$2.50-6.00
Proceed? (Y/n, or adjust optional agents: "+logging -supply-chain")
Wait for user confirmation. If "n", stop. Parse any agent adjustments.
Record timestamp: t_setup_done.
Print:
[Phase 1/3] Deploying {N} QA agents in parallel...
Core: Security & Error, Performance & Resources, Correctness, Architecture, Data Flow, Async Patterns
Optional: {list or "none"}
Launch ALL agents (core + optional) IN PARALLEL in a single message. Each agent gets its scoped file CONTENTS embedded directly -- no file paths to read.
For each agent, use this prompt template:
You are being deployed as part of a QA swarm analysis.
MISSION: {user's original prompt}
IMPORTANT: All source code is provided inline below. Do NOT use the Read tool -- analyze the code directly from this prompt. This is a performance optimization to eliminate file-reading overhead.
FULL FILE TREE (for reference -- paths only):
{the file tree from Step 1}
YOUR SCOPED SOURCE CODE:
{the actual file contents for this agent's tagged files, formatted as === path === \n content}
{Read the agent definition file from agents/qa-{name}.md and include its full content here as the agent's instructions}
Analyze the code provided above according to your specialty. Return your findings as structured JSON.
Core agents and their scoped file contents:
Optional agents and their scoped file contents (if selected):
Launch ALL in parallel (all in one message with multiple Agent tool calls).
Wait for ALL agents to complete. If any agent fails, log it and continue:
Agent {name} failed: {error}
Continuing with {N}/{total} agent results.
Record timestamp: t_swarm_done.
Print:
[Phase 2/3] Aggregating and ranking findings...
Do NOT launch an agent for this step. Perform aggregation inline to save time.
Combine all agent findings. Identify duplicates:
For duplicates, keep the one with higher confidence and build a flagged_by array. Print:
Dedup: {original_count} findings -> {deduped_count} ({removed} duplicates merged)
Review each finding's severity:
Confidence gates:
If P0 but only "suspected" with no corroboration, downgrade to P1 or P2.
Downgrade if evidence doesn't support the tag. No specific file path + code snippet = cannot be "confirmed."
Compile the final report in this format:
# QA Swarm Report
**Date:** {DATE}
**Prompt:** "{ORIGINAL_PROMPT}"
**Agents deployed:** {COUNT} ({CORE_COUNT} core + {OPTIONAL_COUNT} optional)
## Summary
- P0 Critical: {N} findings
- P1 High: {N} findings
- P2 Medium: {N} findings
- P3 Low: {N} findings
- Total: {N} findings ({N} confirmed, {N} likely, {N} suspected)
## P0 - Critical
### [P0-001] {title}
**Confidence:** {confidence} | **Corroborated by:** {N} agents ({agent_list})
**Location:** {file}:{line} in `{function}`
**Description:** {description}
**Evidence:**
\`\`\`
{evidence}
\`\`\`
**Suggested fix:** {suggested_fix}
**Related files:** {related_files}
## P1 - High
(same format)
## P2 - Medium
(same format)
## P3 - Low
(same format)
Rules:
Record timestamp: t_agg_done.
Print a table of ALL findings sorted by severity then confidence:
Findings Summary
==================
| ID | Severity | Confidence | Title | Location | Corroborated By |
|--------|----------|------------|--------------------------------|---------------------------------|--------------------|
| P0-001 | P0 | confirmed | SQL injection in login handler | src/auth.ts:42 `handleLogin()` | 3 agents (SEC,ERR) |
| ... | ... | ... | ... | ... | ... |
Print every finding -- do not truncate.
Print:
[Phase 3/3] Generating implementation spec and test plan...
Launch ONE agent:
qa-fix-planner (model: sonnet):
Read the agent definition from agents/qa-fix-planner.md and include its full content in the prompt.
Record timestamp: t_output_done.
When the agent returns, split its output on the ===SPEC_START=== / ===SPEC_END=== / ===TESTS_START=== / ===TESTS_END=== delimiters to extract the two documents.
Print:
Saving reports...
Get today's date and save the three output files:
docs/qa-swarm/{DATE}-report.mddocs/qa-swarm/{DATE}-spec.mddocs/qa-swarm/{DATE}-tests.mdCreate the docs/qa-swarm/ directory if it does not exist.
Record timestamp: t_save_done.
Compute phase durations (format as Xm Ys):
t_setup_done - t_startt_swarm_done - t_setup_donet_agg_done - t_swarm_donet_output_done - t_agg_donet_save_done - t_output_donet_save_done - t_start minus user confirm waitCount agents dispatched:
QA Swarm Analysis Complete
============================
Findings: {total} ({P0} P0, {P1} P1, {P2} P2, {P3} P3)
Confidence: {confirmed} confirmed, {likely} likely, {suspected} suspected
Phase Timing:
Setup + Pre-read {Xm Ys}
Agent Swarm {Xm Ys} ({N} agents in parallel: 6 Sonnet core + Haiku optional)
Aggregation {Xm Ys} (inline -- no agent)
Fix Planner {Xm Ys} (1 Sonnet agent)
Save Files {Xm Ys}
────────────────────────
Total {Xm Ys} (excludes user confirmation wait)
Agent Usage:
Sonnet : {6 + 1} agents (6 core + 1 fix planner)
Haiku : {optional_count} agents ({optional_count} optional)
Opus : 0 agents
Total : {7 + optional_count} agents dispatched
Report: docs/qa-swarm/{DATE}-report.md
Spec: docs/qa-swarm/{DATE}-spec.md
Test Plan: docs/qa-swarm/{DATE}-tests.md
Immediately after printing the summary, auto-invoke the implement phase in a fresh-context subagent. The subagent starts with zero context from attack -- this is the functional equivalent of /clear before running implement, without requiring manual user action.
Ask the user once:
Proceed to implementation now? [Y/n]
(Selecting Y hands off to a fresh-context subagent running /qa-swarm:implement.
Selecting n stops here -- you can resume later by running:
/qa-swarm:implement docs/qa-swarm/{DATE}-report.md docs/qa-swarm/{DATE}-spec.md docs/qa-swarm/{DATE}-tests.md)
If the user declines (n), STOP.
If the user confirms (Y or empty), spawn a general-purpose Agent with the following self-contained prompt (the subagent has no access to this session's context, so the prompt MUST stand alone):
You are executing the qa-swarm:implement skill in a fresh session.
Invoke the Skill tool with:
skill: "qa-swarm:implement"
args: "{report_abs_path} {spec_abs_path} {tests_abs_path}"
All three files already exist on disk. Read them fresh. Follow the skill
exactly -- including phase selection (present the table, wait for user input
via AskUserQuestion), TDD setup (3 parallel test-writer agents), phase
execution, and final results report.
When the skill completes, return a concise summary: phases run, issues fixed,
issues unresolved, test pass/fail counts, and the path to the results file.
Do not re-describe work the user already saw -- just the outcome.
Use absolute paths for the three files so the subagent's path resolution does not depend on any shared working-directory state.
When the subagent returns, print its summary verbatim and STOP.
Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub mistervitopro/qa-claude-market