skills/team/qraspi-questions/SKILL.md
QRASPI Questions phase -- surface what is unknown about a NEW system before any research, architecture, or skeleton begins. Use for "/qraspi-questions <project>", "new project from scratch", "greenfield X", "questions for a brand-new system". Do NOT use for QRSPI (an EXISTING codebase / adding a feature) -- that routes to qrspi-questions. Do NOT use for the deprecated RPI workflow.
npx skillsauth add michaelalber/ai-toolkit qraspi-questionsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"If you do not know how to ask the right question, you discover nothing." -- W. Edwards Deming
The Questions phase is the first alignment gate of QRASPI's greenfield (V0/V1) path. Before any
domain research, architecture, or skeleton, the agent surfaces every unknown about the new system
as a targeted question and STOPS for the human to answer. Greenfield has no codebase to constrain
the answers, so the danger is a narrow question set that silently commits the design to one
shape. This phase defends against that with a fixed six-category checklist: it enumerates a
question for every greenfield concern whether or not the user named it. A skipped category becomes
an unexamined assumption that cascades into the ADRs; surfacing it here costs one edit in
questions.md, not an architecture rewrite later.
Non-Negotiable Constraints:
questions.md -- the human answers inline before Research beginsquestions.md with progress and
tell the user to start a fresh session.PRE-FLIGHT
[ ] Determine the project slug (kebab-case) and today's date
[ ] Project folder = thoughts/shared/qraspi/YYYY-MM-DD-{slug}/ (create if absent)
[ ] If an ANSWERED questions.md already exists here, this phase is DONE -> route to /qraspi-research
SURFACE
Walk the SIX greenfield categories in order; for EACH, write at least one specific,
answerable question -- never a vague prompt, never skip a category:
functional scope · quality attributes (-ilities) · integration / external systems ·
compliance / regulatory · deployment / runtime target · data & domain model
Mark any question that BLOCKS architecture as [BLOCKING]
WRITE
Create thoughts/shared/qraspi/YYYY-MM-DD-{slug}/questions.md
Use references/questions-template.md
Set status: awaiting-answers
STOP
Tell the user: answer the questions inline in questions.md, then start a NEW session
and run /qraspi-research. Do NOT proceed to Research yourself.
Exit criteria: questions.md written with status awaiting-answers; all six greenfield
categories carry at least one question with blocking items flagged; user told to answer inline and
start a fresh Research session.
<qraspi-questions-state>
phase: PRE-FLIGHT | SURFACE | WRITE | STOP | COMPLETE
project_slug: [kebab-slug]
project_folder: thoughts/shared/qraspi/YYYY-MM-DD-{slug}/
areas_covered: [functional | quality-attributes | integration | compliance | deployment | domain]
# all six MUST be present before WRITE
question_count: [count]
blocking_count: [count]
context_budget: under-40 | approaching-60 | checkpoint-now
status: awaiting-answers | complete
</qraspi-questions-state>
See references/questions-template.md for the full questions.md structure and frontmatter.
| Skill | Relationship |
|-------|-------------|
| qraspi-research | Next phase. Consumes the ANSWERED questions.md to scope the landscape map. |
| qraspi-architecture | Downstream. Every ADR's decision traces back to an answer captured here. |
| qrspi-questions | Brownfield sibling. Use it instead when the system already EXISTS and you are adding a feature. |
| spec-coach | Use instead when you want an interactive design conversation, not a one-shot question dump. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".