Install
$ agentstack add skill-hybridlabor-api-bdb-dev-optimized-agent-skills-td-feature-qa ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
td-feature-qa — verify it works, not just exists
Most defects here live at boundaries, and a tool that returns success can still cook to errors or a black frame. So: read both sides of every boundary together, and check errors after the network cooks, not just the create_* return flag. Run incrementally — validate each feature as it lands so an early boundary bug doesn't propagate.
Gates + suites — always run (offline, no TD needed)
npm run typecheck·npm run build·npm test- biome via
./node_modules/.bin/biome check .(NOTnpm run lint— RTK proxy gives a false ESLint parse error) npm run validate:recipes·npm run test:bridge(python3 -m unittest discover -s td/tests)
Cross-boundary checks — open both sides
| Boundary | Left (producer) | Right (consumer) | Compare | |---|---|---|---| | Tool ↔ CLI | tool's Zod inputSchema | command in src/cli/agent.ts | every param reachable from CLI; types/defaults align; name maps to the right handler | | Tool ↔ registry | register… export | layer*/index.ts + tools/index.ts | actually registered + aggregated, not just written | | Tool ↔ docs | live registry | generated docs/reference/tools.md | regenerates and includes the new tool | | …Impl ↔ test | real return / isError shape | msw test assertions | test exercises the actual shape, not a cast-away generic | | Code ↔ TD | operator types created | what this build can create | optype exists + is createable (dir(td) suffix-match over-counts; ~22 names not createable; KB lags ~14 ops) | | Bridge ↔ client | td/ endpoint/payload | touchDesignerClient.ts + validators.ts envelope | response shape matches the Zod validator |
Live TD validation — when the bridge is up
Policy: offline gates always; live when available. Call get_td_info first.
- Bridge up: build the feature through the agent CLI against the live bridge, capture
get_preview, and checkget_td_node_errorsafter it cooks. - Bridge offline: run offline gates, mark live validation UNVERIFIED — pending bridge in the report. Do not fail the pipeline for a missing TD.
Live gotchas to rule out before declaring a bug:
- Silent failures: a Level TOP has no
gain(it'sbrightness1); no cross-container wires (Select TOP). - Paused timeline: time-dependent chains (motion / frame-diff / feedback / beat) read 0 when
op('/').time.playis false — check it before concluding a reactive chain is dead. - Staleness: a connected
mcp__tdmcp__*runs the old build until restarted; editingtd/doesn't reload the running bridge (reload_bridge/ restart) — suspect stale modules before "fixing" correct code. - GLSL: needs
out vec4 fragColor+ a self-supplied time uniform. - Device sources can hang TD on a macOS permission modal — validate the synthetic/file source first.
Output
A report at _workspace/04_qa_.md with three explicit buckets — PASS, FAIL (file:line + concrete fix + owning agent), UNVERIFIED (what wasn't checked + why, e.g. bridge offline). Never silently skip a check; list it as UNVERIFIED.
Fix loop
- Send each defect immediately to its owner (
td-builderfor handler/schema/test,td-integratorfor wiring/CLI/docs); boundary bugs go to both. Re-validate after each fix. - Cap at ~2–3 rounds per feature; if still failing, report a blocker with full findings instead of looping.
- If a gate fails due to a concurrent agent's unrelated in-flight WIP, say so and validate your slice in isolation (
vitest run).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: hybridlabor-api
- Source: hybridlabor-api/bdb-dev-optimized-agent-skills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.