avav25/qa
plugin/skills/qa/SKILL.md
Use this skill when the user asks to validate a feature, write or improve tests, report a bug, or audit acceptance criteria coverage — /qa = QA-task workflows (verification, test creation, bug reports, exploratory). /test-strategy = test design principles + pyramid + coverage targets (knowledge). /test-local = test execution workflow.
$ install --global
skillsauthnpx skillsauth add avav25/ai-assets qaInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 23, 2026, 4:34 AM28.7s1 file scanned
SKILL.md
- name:
- qa
- description:
- Use this skill when the user asks to validate a feature, write or improve tests, report a bug, or audit acceptance criteria coverage — /qa = QA-task workflows (verification, test creation, bug reports, exploratory). /test-strategy = test design principles + pyramid + coverage targets (knowledge). /test-local = test execution workflow.
- context:
- fork
- argument-hint:
- [feature description, bug report, or test target]
QA
Use this workflow for verification and test quality work.
Domain Expertise
Three industry-canonical frameworks shape every QA task in this skill.
Heuristic Test Strategy Model (Bach / Kaner)
Questioning lenses for test design. Walk through each mnemonic for any new feature to surface test conditions before writing tests.
| Mnemonic | Lenses | Use for | |---|---|---| | SFDPOT ("San Francisco Depot") | Structure, Function, Data, Platform, Operations, Time | Product coverage — what to test | | CIDTESTD | Capability, Inputs, Data, Tests, Errors, Stress, Time, Design | Test technique selection — how to test |
Reference: James Bach, Rapid Testing Methodology and the HTSM one-page reference.
Session-Based Test Management (Bach 2000)
Structure for exploratory testing.
| Element | Length | Contents | |---|---|---| | Charter | 30–120 min | Focused mission, e.g., "Investigate file upload handling under network failure" | | Session report | Written during session | Time, charter, areas covered, bugs, issues, todo, % time on test design vs investigation vs setup | | Debrief | 5–15 min | Review with team lead — surfaces patterns, refines future charters |
Reference: Jonathan Bach, SBTM 2000 paper.
Risk-Based Testing (ISO/IEC/IEEE 29119-1)
Test depth scales with risk score = Probability × Impact (3×3 matrix, H/M/L per axis, 9 cells).
| Probability factors | Impact factors | |---|---| | Code complexity | Business criticality | | Change frequency | User-base size | | Dev team experience | Regulatory exposure | | Third-party dependency churn | Financial loss potential |
High P × High I → exhaustive testing + automation. Low P × Low I → smoke only.
1. Determine the QA Task
Classify the request as one of:
- Feature verification
- Bug report
- Test creation
- Test improvement
- Exploratory testing
- Coverage review
2. Gather Context
Read:
TESTING.mdif present- Root
AGENTS.md - Relevant scoped
AGENTS.md - Feature brief, bug report, or changed code in scope
- Existing tests for the target area
3. Execute the Task
Feature Verification
- Map acceptance criteria to observable behavior
- Check happy path, edge cases, and error paths
- Record pass, fail, or partial status with evidence
Bug Report
- Reproduce the issue
- Capture logs, errors, and minimal repro
- Write a structured report using the template below
Bug report template (all fields required unless marked optional):
| Field | Format / values |
|---|---|
| Title | One line, includes severity hint, e.g., [BUG] Login button unresponsive after 2 failed attempts |
| Severity | S1 Critical / S2 Major / S3 Minor / S4 Cosmetic (impact on system) |
| Priority | P1 / P2 / P3 / P4 (urgency to fix — separate from severity) |
| Steps to reproduce (STR) | Numbered, deterministic |
| Expected behavior | What should happen |
| Actual behavior | What happens instead |
| Environment | OS / browser / app version / build / device / region |
| First seen | Timestamp + commit / release / build |
| Repro rate | 1/1, 1/10, intermittent, etc. |
| Attachments | Screenshots / video / logs (attached or linked) |
| Workaround | If known (optional) |
Test Creation or Improvement
- Identify coverage gaps
- Write or improve tests using the project's existing patterns
- Prefer deterministic tests and narrow scope first
Exploratory Testing
- Identify risky or recently changed areas
- Explore happy path, invalid input, state transitions, and regressions
- Record issues with severity and reproduction steps
Coverage Review
- Review current coverage signals
- Identify important untested logic
- Recommend the next highest-value tests
4. Apply the Quality Gate
Check:
- Existing tests still pass
- New tests are deterministic
- Acceptance criteria are covered where relevant
- Bug reports include evidence and reproduction steps
5. Report
Summarize:
- What was tested
- Issues found
- Tests added or improved
- Coverage impact if relevant
- Recommended next steps
Integration
- Companion skills:
test-strategy,run-tests,test-local - Common follow-up:
bugfix,feature-dev,pre-commit
Related Skills
avav25/knowledge-sync
development
VerifiedTrustedCommunity
Use this skill when running the recurring (daily) knowledge-base rescan for a repo that already has knowledge/.knowledge-sync.yml — the main-thread dispatcher that reads the config, computes the git delta since last_scanned_sha, maps changed paths to affected doc areas, early-exits cheaply when nothing changed, then fans out one Agent(content-writer) per affected area, applies the propose/direct update policy, advances the baseline only on success, and writes an L4 run log — all with the G1 untrusted-content choke-point, secret-scan, deny-list, and budget controls woven in. For first-time setup use /knowledge-sync-init.
1SKILL.mdUpdated May 24, 2026
avav25/knowledge-sync-init
development
VerifiedTrustedCommunity
Use this skill when bootstrapping scheduled knowledge-base sync for a repo that has no knowledge/.knowledge-sync.yml yet — to run one-time setup that detects the knowledge_root from CLAUDE.md/AGENTS.md, maps doc areas to source globs, records opt-in external sources (Linear/Notion/WebFetch, all disabled by default), captures a baseline last_scanned_sha, sets the per-area update policy, generates or seeds knowledge/CONVENTIONS.md, provisions the L4 memory dir, and offers to register the daily routine. Routes ongoing recurring sync operations to /knowledge-sync.
1SKILL.mdUpdated May 24, 2026
avav25/ai-skills-init
tools
VerifiedTrustedCommunity
Use this skill when bootstrapping a target repository to be ai-skills-aware — on the first run of any ai-skills workflow in a fresh repo, when adopting the ai-skills plugin in an existing repo, or after upgrading to a plugin version that adds new memory paths or templates, including when the user does not say "init" but asks to "set up" or "onboard" the repo — to detect codebase type, create CLAUDE.md + AGENTS.md scaffolding, initialize the .ai-skills-memory/ directory tree from L1 templates, and configure .gitignore. Idempotent — safe to re-run. Accepts `--codebase-type <type>` and `--overwrite`. Not for re-initializing only memory — use `/memory-init` instead.
1SKILL.mdUpdated May 18, 2026
avav25/plugin-author
tools
VerifiedTrustedCommunity
Use this skill when extending, repairing, or improving plugin assets, when ingesting a `/feedback` report as a fix-cycle backlog, or when you do not remember which lower-level command is right for the job — the umbrella workflow for ai-skills plugin-asset authoring and maintenance: creating, auditing, fixing, improving, refactoring, and migrating skills, agents, rules, hooks, prompts, schemas, and rubrics inside the plugin. Auto-classifies the request, loads the right knowledge skills (`@prompt-engineering`, `@context-engineering`, `@team-protocols`), and spawns the right subagents (`prompt-engineer`, `system-architect`, `python-engineer`, `software-engineer`, `qa-engineer`, `eval-judge`) via the `Agent` tool.
1SKILL.mdUpdated May 14, 2026