vostride/agent-qa
C2Open-source self-improving QA agent for software teams. A test harness with memory. Write tests in natural language for web and mobile. agent-qa learns from every run, adapts to UI changes, and catche
★ 500+ · vostride/agent-qa source on GitHub · this plugin in the registry
vostride/agent-qa is a DeepSeek Harness plugin rated C2 — one powerful capability or sensitive behavior. It executes system commands, decodes base64 payloads, starts a network server.
What it can do
| Capability | Flag | Evidence |
|---|---|---|
| executes system commands | exec | ×31 src, e.g. packages/core/src/sqlite.ts:1, packages/core/src/sqlite.ts:1 |
| decodes base64 payloads | base64_decode | ×2 src, e.g. packages/android/src/adapter.ts:475, packages/android/src/adapter.ts:570 |
| starts a network server | net_server | ×2 src, e.g. packages/dashboard-server/src/server/server.ts:476, packages/dashboard-server/src/server/server.ts:641 |
Outbound domains
api-cloud.browserstack.com www.iana.org hacker-news.firebaseio.com us.i.posthog.com docker.com automationexercise.com news.ycombinator.com automate.browserstack.com app-automate.browserstack.com openrouter.ai
Environment variables it reads
AGENT_QA_RUN_ID AGENT_QA_SUITE_QUEUE_ID AGENT_QA_APPIUM_URL AGENT_QA_LIVE_EVENTS AGENT_QA_LLM_MODEL AGENT_QA_LLM_PROVIDER AGENT_QA_RUN_ATTRIBUTES_JSON AGENT_QA_PARENT_RUN_ID AGENT_QA_ATTEMPT_NUMBER AGENT_QA_MAX_RETRIES
How to read this
Levels measure capability surface and transparency, not maliciousness. A C3 plugin can be entirely legitimate — a desktop shell genuinely needs subprocesses. The point is that you can see this before installing. See the levels explained and how dsh plugins work.
Findings come from static analysis of shipped code; nothing is executed. Think a flag is wrong? Open an issue — every flag cites the file and line it came from.