​

Built-in skills

Qodex ships with skills for the most common testing and review jobs. The coordinator chooses from these skills based on what you ask it to do. You usually do not need to pick a skill manually. Ask for the outcome you want, such as “test my checkout API” or “create UI tests for login”, and Qodex routes the work.

​

Shipped skills

​

Orchestrator and author skills

Some skills plan the work. Others do a narrow slice of it. api and ui are orchestrator skills. They understand the full request, split it into smaller pieces, and decide which sub-agents to run. api-author and ui-author are authoring skills. They are usually spawned by the orchestrator and focus on one scenario or one endpoint group at a time. This split helps Qodex stay organized during larger runs. The coordinator keeps the main goal in view while sub-agents collect evidence and create scenarios in parallel.

​

Security and pentest difference

Use security for structured security testing: OWASP checks, access-control probes, headers, and repeatable security scenarios. Use pentest for deeper, more active testing where Qodex tries to chain behaviors into exploitable paths. Pentest runs have stricter safety rules: no destructive payloads, no real-user PII exfiltration, test accounts only, and bounded request rates.

​

Performance scope

The performance skill measures baselines and regressions. It is not a full load-testing engine. For APIs, it records latency signals such as p50, p95, p99, and jitter. For pages, it checks Core Web Vitals-style measurements such as FCP, LCP, CLS, and TTI.

​

Skills on the roadmap

Older internal docs mention skills that are not currently shipped as .skill.md files. The main planned gap is an accessibility skill for axe-core, WCAG checks, contrast, keyboard navigation, screen reader behavior, and responsive zoom. Current shipped equivalents:

​

Next steps