CodexQA

CodexQA Skills · open source · runs locally

Eleven verification skills, one command away

Defect scans, change impact, evidence-based review, test cases and data, browser runs and root-cause analysis. They run locally in your coding agent and write their reports to disk.

Start with the skill router (recommended)Cursor · Claude Code · Codex · OpenClaw
$ npx skills add openqa-cn/codexqa --skill codexqa-skill-router

It matches your request to the other ten skills and, with your consent, installs the ones you are missing. Pick your agent at the prompt; no npm account needed.

Browse the 11 skillsSource on GitHub ↗
verification skills
11
verification skills
coding agent
Any
coding agent
licence
Apache-2.0 / MIT
licence

Three steps

Install, say what you need, open the report. No new test platform to move to.

  1. 1

    Install the router

    Run it in your project and pick Cursor, Claude Code, Codex or OpenClaw. It installs into the current project; add --global to use it everywhere.

    $ npx skills add openqa-cn/codexqa --skill codexqa-skill-router

    For example, install for Codex across projects

    $ npx skills add openqa-cn/codexqa --skill codexqa-skill-router --agent codex --global
  2. 2

    Open a session and ask

    Not sure which skill you need? Let the router choose. If you know, name the skill.

    Let the router choose

    I am not sure which skill to use. Route this: review this repo against origin/main and produce an HTML report I can send to a reviewer.

    Or name a skill

    Use codexqa-defect-analyzer on this branch. Requirement: a refund may not exceed the refundable balance.

  3. 3

    Open the report on disk

    The report (HTML or Markdown) lands on your disk; the HTML ones can go straight to a reviewer. Findings carry location and evidence, and still need a human to confirm.

    See a sample review report

Eleven skills, each owns one step

Each skill installs on its own. Click a screenshot to open the sample report it produced; every sample is hosted on this site.

The six skills marked “Local engine” also need the separately distributed @openqa-cn/codexqa analysis engine (closed source, no account). Indexing and graph queries run on your machine.

Start here · this one is enough to begin

Skill router

codexqa-skill-router

Verifies
You are not sure whether you need a defect scan, blast radius, cases or data, or the worker skill is not installed yet.
You get
Matches your request to the right skill and, with your consent, installs it on demand before handing over.

Needs · Python 3.10+; on-demand install needs network

$ npx skills add openqa-cn/codexqa --skill codexqa-skill-router

Then open a session and say

I am not sure which skill to use. Route this: review this repo against origin/main and produce an HTML report I can send to a reviewer.

Source ↗

  • Before you merge

    Change impact analysis

    codexqa-code-analyzer

    Verifies
    Which APIs, methods and call chains this change hits, what to regression-test, and which paths have no tests.
    You get
    Callers, entry points and untested edges from a local symbol graph, ready to become a regression list.

    Needs · Node.js 18+Local engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-code-analyzer

    Open sample report ↗Source ↗

  • codexqa-change-analysis

    No public sample report yet

    Before you merge

    Change impact report

    codexqa-change-analysis

    Verifies
    For one diff: which methods changed, which APIs or pages reach them, and which of those paths no test covers.
    You get
    A self-contained HTML impact report, plus new runnable test files for uncovered points. Existing tests are not edited. English by default.

    Needs · Node.js 18+; the repo under test must startLocal engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-change-analysis

    Source ↗

  • Before you merge

    Defect & security scan

    codexqa-defect-analyzer

    Verifies
    Whether code you just wrote or merged hides bugs, secrets or unsafe patterns a quick glance would miss.
    You get
    SAST, lint and secret scans merged with one semantic pass into a P0–P3 HTML report: location, evidence, fix.

    Needs · Python 3.10+ (3.11 recommended)Local engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer

    Open sample report ↗Source ↗

  • Before you merge

    Evidence-based code review

    codexqa-code-reviewer

    Verifies
    Whether the change is merge-ready and whether it silently hits old behaviour, which a diff alone rarely shows.
    You get
    An evidence pack of callers, blast radius and test edges, then a bilingual REVIEW-REPORT.html for the reviewer.

    Needs · Node.js 18+, bash, jq, Python 3.10+Local engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-code-reviewer

    Open sample report ↗Source ↗

  • Before a test pass

    Requirement analysis

    codexqa-requirement-analyzer

    Verifies
    Whether a requirement is testable, complete and consistent, before anyone writes code.
    You get
    A P0/P1 register of gaps and conflicts from a PRD, with executable verification steps for the top items.

    Needs · The common setup only; the agent does the analysis

    $ npx skills add openqa-cn/codexqa --skill codexqa-requirement-analyzer

    Open sample report ↗Source ↗

  • Before a test pass

    Test case generation

    codexqa-testcase-generator

    Verifies
    What a full test pass should cover for Web, server and apps, without inventing facts the PRD does not state.
    You get
    A local test plan and cases with unknowns marked TBD, aggregated into an HTML you can open.

    Needs · Python 3.10+

    $ npx skills add openqa-cn/codexqa --skill codexqa-testcase-generator

    Open sample report ↗Source ↗

  • Before a test pass

    Test data construction

    codexqa-testdata-generator

    Verifies
    Whether the preconditions in a case can really be built on the backend. A copied fake ID will not pass.
    You get
    Builds data against the real backend and writes the returned IDs back into the case preconditions.

    Needs · Node.js 22+; a backend adapter for real systems

    $ npx skills add openqa-cn/codexqa --skill codexqa-testdata-generator

    Open sample report ↗Source ↗

  • Run and diagnose

    Browser execution

    codexqa-jev-browser

    Verifies
    Whether a browser flow reaches the visible evidence named in the goal. A model saying DONE is not a pass.
    You get
    Replays YAML, Markdown or API cases, or generates one from a goal; each run writes an HTML report with marked screenshots.

    Needs · Node.js 20+, Playwright Chromium; goal runs need your own model API key, replays do not

    $ npx skills add openqa-cn/codexqa --skill codexqa-jev-browser

    Open sample report ↗Source ↗

  • Run and diagnose

    Root-cause analysis

    codexqa-rootcause-analyzer

    Verifies
    Where a failure really starts once the stack and logs are mapped onto the repo. The throw site is often not it.
    You get
    A gated RCA that separates trigger, root cause and confidence, with one fix you can verify, as an English Markdown report.

    Needs · Node.js 22+Local engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-rootcause-analyzer

    Open sample report ↗Source ↗

  • Understand the repo

    Architecture wiki

    codexqa-code-wiki

    Verifies
    How the repo is layered, where the hubs are and where a newcomer or an agent should start reading.
    You get
    A local architecture graph of communities, real dependencies and reading paths, as HTML you can open.

    Needs · Node.js 18+Local engine

    $ npx skills add openqa-cn/codexqa --skill codexqa-code-wiki

    Open sample report ↗Source ↗

Chained by situation

What it is not

Questions

Do I need an account?

No CodexQA or npm account. npx skills add is a community installer that fetches the skill files from GitHub. Your agent and model have their own account terms, and the browser-execution skill needs your own model API key for goal-driven runs.

Which one should I install?

If unsure, only the skill router: it matches your task to the others and installs missing ones with your consent. Or install the skill you need directly, or copy all eleven commands at once.

What does my machine need?

Node.js, npm/npx, Git, and a coding agent that can read skill files and run commands. Extra runtimes (Python 3.10+, Node.js 18/20/22+) are listed under “Needs” on each card.

Does anything run on install?

No. Installing only lets the agent read the files. Open a session and give it a repo, a branch, a requirement or other material.

How do I update or remove them?

With the installer: npx skills list shows what is installed, npx skills update updates, npx skills remove <name> removes. npx skills --help has the current options.

How do they relate to Timo and the platform?

The skills are the free starting point for one person and one repo inside an agent. Timo, which brings AI roles for requirements, code, testing and review and can load these skills, and the CodexQA platform are in internal use today; you can book an evaluation.

Community skills

Verification skills published by other teams and listed here.

How ranking worksSubmit a skill →

ListPipeline map
AI 系统评测Remove filterClear all

Community listings are being prepared. You can submit your skill now.

Submit a skill