michaelalber/qa
skills/qa/SKILL.md
Performs structured QA review of a feature, PR, or implementation: verifies acceptance criteria coverage, generates edge case test cases, and flags gaps before shipping. Use when asked to "QA this", "review for quality", "write QA test cases", "find edge cases", or before marking a feature done. Ported from https://github.com/mattpocock/skills (Matt Pocock).
testing
Updated Apr 26, 2026
$ install --global
skillsauthnpx skillsauth add michaelalber/ai-toolkit qaInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 2:58 PM1.7s1 file scanned
SKILL.md
- name:
- qa
- description:
- >
- Performs structured QA review of a feature, PR, or implementation:
- verifies acceptance
- Ported from https:
- //github.com/mattpocock/skills (Matt Pocock).
Perform structured QA review.
Protocol
1. Load acceptance criteria
From the PRD, issue, or conversation. If none exist:
"I need acceptance criteria before reviewing. Please provide them or run to-prd first."
2. Verify happy path — for each AC:
- [ ] Is this criterion met by the current implementation?
- [ ] Is there an automated test covering it?
3. Generate edge case test matrix — see references/edge-case-taxonomy.md:
| Scenario | Input | Expected behavior | Priority | |----------|-------|------------------|----------| | Empty / null input | [describe] | [expected] | High | | Boundary values | [describe] | [expected] | High | | Invalid format | [describe] | [expected] | High | | Concurrent access | [describe] | [expected] | Medium | | Large volume | [describe] | [expected] | Medium | | Dependency failure | [describe] | [expected] | Medium |
4. Flag gaps:
- Acceptance criteria not met by the current implementation
- Missing automated test coverage
- Edge cases with no defined behavior (requires a decision)
5. Report:
## QA Report: [Feature / PR Name]
**AC coverage:** [N/N met] | [N/N tested]
**Gaps:**
- [ ] [gap + recommended fix or decision needed]
**Edge cases to add:**
- [ ] [test case description]
**Ready to ship:** Yes / No — [reason if No]
Related Skills
michaelalber/grilling
development
VerifiedTrustedCommunity
Interviews the user relentlessly about a plan, decision, or idea — one question at a time, each with a recommended answer. Shared engine behind "grill-me" and "grill-with-docs". Use on any "grill" trigger phrase or to stress-test thinking. Do NOT use to build the plan; it ends at shared understanding, not implementation.
1SKILL.mdUpdated Jul 23, 2026
michaelalber/grill-with-docs
testing
VerifiedTrustedCommunity
Runs a relentless interview to sharpen a plan or design, capturing the decisions as ADRs and a glossary along the way. Use when the user wants to be grilled AND wants the session to leave durable domain documentation behind. Do NOT use for a throwaway stress-test with no artifacts; use grill-me instead.
1SKILL.mdUpdated Jul 23, 2026
michaelalber/vue-security-review
tools
VerifiedTrustedCommunity
OWASP-based security review of Vue/TypeScript front-ends. Detects framework (Vite/Vue CLI/Nuxt), entry points, and data flows; scans the OWASP Top 10 (2025) mapped to Vue client-side risks (raw-HTML XSS via v-html, URL/protocol injection, bundled secrets, insecure token storage, dependency CVEs, missing CSP, open redirects, router guard bypass); emits an exec summary plus graded findings. Use to audit Vue for vulnerabilities. Not for architecture grading (vue-architecture-checklist).
1SKILL.mdUpdated Jul 20, 2026
michaelalber/vue-modernization-analyzer
tools
VerifiedTrustedCommunity
Analyzes legacy Vue codebases and produces actionable modernization plans. Primary migration paths include Options API to Composition API, Vue 2 to Vue 3, Vue CLI to Vite, JavaScript to TypeScript, Vue Test Utils/Karma/Mocha to Vitest + Vue Testing Library, legacy Vuex to Pinia, and removed-in-Vue-3 pattern cleanup (filters, event bus, `$listeners`). Does NOT perform the migration — assesses, quantifies risk, and plans.
1SKILL.mdUpdated Jul 20, 2026