CodexQA skill
Eleven skills to verify AI-written code: change blast radius, defect scan, review report, test cases and browser flow replay
- 238 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The skills read the repository and branch history and write reports to disk, and one replays a flow in a browser.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/codexqaDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The skills read the repository and branch history and write reports to disk, and one replays a flow in a browser.
This is third-party code. Review the repository files before installing.
What it does
CodexQA is a pack of ten worker skills and one router, `codexqa-skill-router`. The router picks the right skill and fetches it on demand. The skills run locally and write results to files: HTML and Markdown. The pack includes `codexqa-change-analysis` and `codexqa-code-analyzer` for blast radius across calls and methods, `codexqa-defect-analyzer` for logic defects and secrets, `codexqa-code-reviewer` for the `REVIEW-REPORT.html` review page, `codexqa-requirement-analyzer` for requirement gaps, `codexqa-testcase-generator` and `codexqa-testdata-generator` for test cases and data, `codexqa-code-wiki` for an architecture graph, `codexqa-rootcause-analyzer` for failure root cause analysis and `codexqa-jev-browser` for browser flow replay. The README reports a single run on the inventory-service example: 7 of 7 planted defects found with 4 decoys, one run with no model comparison.
Who it is for. QA engineers and developers who want to verify agent-written code before merge and get reports they can open and send to a reviewer.
Good fit when
- Before merging a branch you need to know which old features it touches and get a regression list.
- A reviewer needs a page with findings for the branch relative to `origin/main`.
- From a PRD you need to find requirement gaps and build test cases with data.
- After an incident you need a root cause analysis with stop conditions and evidence.
Not a fit when
- You need a test management platform with accounts: CodexQA runs in an agent session and writes files.
- You need a guaranteed result without a human: findings need review.
- The project is not in git and has no code for call analysis: part of the skills rely on history and code structure.
Example request
Compare this branch with `origin/main` and build a page for the reviewer: affected calls, defects and test gaps.Limitations
All skills are local: no account or gateway is needed and files stay on your machine. A human needs to read the reports because findings can be false. The 7 of 7 figure comes from one run on the JavaScript sample inventory-service and does not replace a model comparison. Semgrep seeds cover 102 rules across ten languages. The `codexqa-jev-browser` skill replays a flow in the browser, so read `docs/SUPPORT_MATRIX.md` with the agent support table before installing.
How to disable. Remove the `codexqa-*` skill folders from your agent skills directory or uninstall them with the `npx skills` manager.
FAQ
How do I install CodexQA?
Run `npx skills add openqa-cn/codexqa --skill codexqa-skill-router`: that is enough, the router fetches other skills on demand.
How do I install one specific skill?
Give its name, for example `npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer`.
Which agents does the pack work with?
Cursor, Claude Code, Codex and OpenClaw; `npx skills` asks which to use during install.
What reports do I get?
Blast radius, an HTML defect page with P0 to P3 priorities, a bilingual `REVIEW-REPORT.html`, a requirement gap register and test cases.
Is registration needed?
No, the skills run locally without an account.
Discussion
No questions or reviews yet.
Related
SkillsTwo skills for Codex and Claude Code: a read-only repository audit and an experiment loop with saved baselines.
A library of 169 QA skills per language: test design, API, UI, regression, load, security and LLM testing.
The evidence-code-review skill for Codex and Claude Code: evidence-based change review with MUST, SHOULD, BETTER and NITS levels
Thirteen testing skills from requirements to report: strategy, cases, API checks, Playwright and flaky-test triage.
OpenQodex reviews your change before a push: scanners with no model first, then a separate Claude Code or Codex process triages findings on your login
Fifty testing skills for Claude Code, Codex and Cursor: Playwright, strategy, API, visual and load checks.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| CodexQA (this card) | no | 238 | ||
| Jev-Code-Reviewer | no | 152 | Jev-Code-Reviewer does code review, while CodexQA adds blast radius, test cases, data and root cause analysis. | |
| code-review-graph | no | not required | 32,733 | code-review-graph builds a review graph through MCP, while here is a skill pack with HTML reports and no server. |
README in short
The repository is the skill source for the openqa.cn site: it holds ten skills and a router, examples and a support matrix. Installation goes through `npx skills`, Apache-2.0 license.