单独安装技能不会安装 QA runner CLI，要用 runner 需克隆完整仓库并执行 npm ci；runner 的激活依赖宿主读取项目的 AGENTS.md，不会安装后台 agent；技能选择由宿主 agent 决定，请求可能匹配多个技能时需显式点名技能
qa-skills
petrkindlmannMIT活跃维护一套面向 Claude Code、Codex、Cursor 等 Agent 运行时的 50 个 QA 与测试自动化技能包，让 AI 编码助手直接具备编写端到端测试、接入 CI/CD 的能力。
50 QA and test-automation skills for Claude Code, Codex, Cursor, and any Agent Skills Standard runtime.
v3.5.0发布于 2026-10-22 09:52 UTC261star +8 / 7 天41fork同步于 2026-11-11 00:01 UTC
npx skills add petrkindlmann/qa-skills 硬件要求按 README 说明
README 未说明
有 Docker 镜像
给 AI 编程助手用的 50 个 QA 与测试自动化技能包，让 Agent 按标准流程写测试、做评审和排障
一套面向 Claude Code、Codex、Cursor 等 Agent 运行时的 50 个 QA 与测试自动化技能包，让 AI 编码助手直接具备编写端到端测试、接入 CI/CD 的能力。
核心能力
- 按 Agent Skills Standard 提供 50 个技能，覆盖策略、自动化、CI/CD 等 10 类
- 每个技能用精简 SKILL.md，重代码放 references 按需加载
- 支持按需安装单个技能，如 playwright-automation、test-strategy
- 附带本地 QA runner，可发现测试命令并产出 HTML/JSON 证据报告
- 覆盖 Playwright/Cypress、API、移动端、可访问性、安全、性能等场景
容易踩的坑
内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README
- v3.5.0v3.5.0 — semantic judge, ten more skills against software, and a with-and-without comparison最新正式版2026-10-22 · 2026-10-22 09:52 UTC
A semantic judge, ten more skills against software, and a with-and-without test
The collection stays at 50 skills. v3.5.0 checks them from three new directions: a model judge reads every prose eval criterion against the skill's own text, ten more skills author suites blind against the lab applications, and nine blind agents take the same Shop task with four skills, with only the agent rules, or with neither. On that task the skills did not raise detection. The notes below say why, and what changed because of it.
v3.5.0
Semantic judge, two more result adapters, ten more skills against software, a with-and-without comparison
- Add
scripts/judge_evals.py: a model judge for the 808 semantic eval criteria the static checker defers, one call per skill, every "yes" verdict tied to a verbatim quote found in the document or recorded as unverified. Three passes: 1,109 verdicts, none unverified, 15 findings, which became 8 skill repairs and 7 re-phrased criteria; the method, cost and findings are in the judge report. - Triage the 32 failing static eval cases to zero without loosening the gate: 511 of 511 checkable cases pass, 5 cases are live-only.
- Add JUnit XML and CTRF JSON result adapters to the QA runner (
reporter: junit-xml | ctrf-jsonwithresultFile), with a fresh-file rule, suite-counter reconciliation, Surefire rerun and CTRF retry handling, evidence copies and report links; Vitest discovery writes a JUnit file. Verified against real pytest 9.1.1 and Vitest 5.0.5 output. An odiff recipe joins visual-testing; the registry lists both adapters and odiff. - Campaign 3: ten skills that had never been run against software (visual-testing,
bug-reproduction, selector-drift-recovery, synthetic-monitoring,
analytics-tracking-testing, service-virtualization, test-migration,
test-suite-curation, test-data-management, chaos-engineering) each authored a suite
blind against the lab's Shop or TodoMVC. The controls matrix established 34 of 36 cases
(10 healthy controls, 24 designated-assertion detections); the two others are recorded as
suite limits. Six faults joined the lab (
redesign-classes,style-regression,slow_health,wrong_currency_event,reset_email_dropped,catalog_currency_missing), TodoMVC faults stack, and the matrix accepts declared quarantines, re-designated oracles and a per-case worker count. 93 recorded recipe difficulties became repairs in those ten skills;AGENTS.mdnow treats an unfilled context template as absent. Report: campaign 3. - With-and-without comparison: one Shop task given to nine blind agents, three with four skills, three with only the agent rules, three with neither, scored on nine pre-registered faults and ten exploratory ones. All nine suites caught eight of the nine; only the skills arm caught the ninth (a signature verified over re-serialized JSON) in every take, while on the exploratory set it caught 15 of 30 against 16 and 18, missing two contract clauses outside its skills' subjects. The scorer needs two healthy controls and a confirmed repeat per detection, records wall-clock bounds, and runs a secondary set apart from the score. Findings, the circularity of the primary set and other limits: with and without.
- Repairs from that comparison:
api-testingasserts a 429 and itsretry-afterunconditionally, falls back to an exact key-set check when no schema library may be installed, and requires every contract clause to have a test or a "not covered" line;payment-testingtakes the bad-signature status from the provider or contract instead of Stripe's 400;email-testingwarns that a Mailpit delete with an empty ID list empties
- Add
- v3.4.0v3.4.0 — executable QA routing and evidence reports2026-10-21 · 2026-10-21 10:56 UTC
查看更新说明
A runner, a wired-in QA loop, and evidence reports
The collection stays at 50 skills. v3.4.0 adds the executable path from a project goal to selected skills, bounded checks, observed results and a readable report, and it ships the first recorded case of a host agent finding and repairing a defect under that workflow.
v3.4.0 — executable QA routing and evidence reports
npm run qa -- plan|run|init --wire-agent(scripts/qa.mjs,tools/qa/): project discovery, goal- and diff-based skill selection with reasons, argv-array checks with per-check deadlines and a total budget, a browser readiness and accessibility phase for a running URL, and a per-run directory withreport.html,result.json,plan.json,agent-handoff.mdand concise/verbose logs. Typed result adapters cover Node TAP and Playwright JSON; anything else stays incomplete rather than passing on exit code alone.init --wire-agentadds an idempotent, bounded QA workflow block to a project'sAGENTS.mdand aqa.config.jsonif absent. The host reads skills and makes authorized repairs, with a two-attempt limit; the CLI never calls a model.qa-doandqa-startnow carry an action request through execution instead of stopping at a routing recommendation or a planning document.qa-dashboardandrelease-readinessread the observed run.- Fresh application task: a new agent reviewed the Parcel Desk quote fixture, found a free-shipping boundary bug the existing three tests missed (subtotal 5000 still charged 500), wrote three failing regressions, repaired
>to>=, and finished at 49 passing assertions including 26 real HTTP checks. Reverting the comparator makes the regression fail again. Evidence underdocs/evidence/qa-orchestration-2026-10-21/field-use/. - Matrix hardening: unique run directories, an exclusive output lock with child tracking, process-group cancellation on interruption, a typed oracle attachment bound to the run token, infrastructure failures (including
net::ERR_CONNECTION_REFUSED) rejected instead of counted, and unrun variants retained after a failed healthy control. The interrupted run that motivated this is kept asmatrix-interference.json. - Gate and recipe repairs: the agentic-browser CI self-grade is replaced by a typed independent-oracle gate; accessibility recipes carry all five cumulative WCAG tags and require the intended page before scanning; hosted-inbox requests get a deadline covering headers and body;
QA_PYTHONis honored through a shared launcher; subprocess cleanup kills descendants that outlive their parent. - Review pass before landing: an independent code review of the implementation reported fifteen findings. Repaired: the Playwright JSON adapter now survives a package manager's trailing failure line, discovery inserts
--for npm only (pnpm forwards it), a report-only goal still routes to an executing skill, a malformed result entry or unexpected throw no longer discards earlier evidence, environment values are redacted only when they look like secrets, lockfiles are hashed by stream, the browser worker publishes each phase and bounds the axe scan, and the matrix lock and oracle helper fail safe. Details in the report's "Review pass before landing" section. - README: an eight-second "Tests need tests, too" motion graphic (
docs/media/qa-skills-proof.gif, reproducible withscripts/render-proof-animation.py) and a runner section. Three video storyboards indocs/VIDEO-SCENARIOS.md.
Report: docs/QA-ORCHESTRATION-2026-10-21.md · Runner guide: docs/QA-RUNNER.md
Verification
Hosted CI on the PR commit: validate, executable-recipes and application-workflows all green. On macOS arm64 (Node 26, Python 3.14): validator, index check, static evals 484/516 and 133 Python tests pass;
npm test116,npm run test:qa34 and `np - v3.3.0v3.3.0 — executed against running software2026-10-21 · 2026-10-21 03:15 UTC
查看更新说明
Executed against running software
Since v3.0.0 the collection has stayed at 50 skills, but the evidence behind them changed. Three campaigns now run on every push: the helpers in the Markdown code fences are loaded and executed, a pinned official TodoMVC, a local HTTP/SQLite Shop and the real Mailpit binary are driven through Playwright, and 22 deliberately broken application variants must each be caught by a named assertion.
v3.3.0 — addon workflows, macOS support, four skill repairs
- Eleven acceptance cases for
accessibility-testing,database-testing,security-testingandperformance-testingover the same fixtures: axe scans of every reachable state with a documented upstream baseline, a keyboard-only sign-in, hashed-at-rest and constraint checks read straight from SQLite, a clock-driven failed-login throttle, locked support routes, uniform password reset under a mail outage, and LCP/CLS lab budgets with an anchored entry field. - Eight matching fixture faults. The controls matrix runs 23 variants. The first CLS control escaped at a score of 0.07 (a 240 px jump of a compact app scores under the 0.1 budget), so the recipe and the skill now anchor the key control as well as the score.
- Mailpit pinned per platform (Linux AMD64 and macOS arm64) with GitHub's asset digests, HTTPS-only download without curl,
ps-based liveness where/procis absent,python3by default. The whole suite runs on an arm64 Mac as well as in CI. - Skill repairs: pin the current axe release instead of a stale minor, fail an axe scan that evaluated nothing, add throttle, locked-route and SQLite at-rest recipes.
- Community: skill-catalog tables in
AGENTS.mdnow render (#2, @victorandraad); ShazaMail added as a hosted receive-only inbox option inemail-testing(#4, @eliechama).
Report: docs/WORKFLOW-ADDONS-2026-10-21.md
v3.2.0 — real application workflows
Fresh-agent authoring, independent review and review-driven follow-up against TodoMVC, the Shop and Mailpit. The original suites caught 11 of 14 deliberate defects; the final suites catch 14 of 14.
playwright-automationandapi-testingmoved to 2.1 after their starter config, worker-auth recipe and migration command failed when executed.Report: docs/REAL-WORKFLOWS-2026-10-21.md
v3.1.0 — stress tests and evidence-aware recipes
Regression tests that execute documented helpers and controlled browser fixtures; validator, evaluator and injection-scanner hardening; repairs across consent observation, GA4 parsing, email polling, webhook handling, MSW ordering, selector recovery, Allure configuration and PostgreSQL recipes.
Report: docs/STRESS-TEST-2026-10-20.md
Limits
Chromium only. Lab budgets are loopback numbers. Fixture throttles, support routes and mail outages stand in for a real service's own. Static evals remain lexical coverage, not an agent success rate.
- Eleven acceptance cases for
- v3.0.0v3.0.0 — 50 QA Skills, TDD-validated2026-06-10 · 2026-06-10 18:06 UTC
查看更新说明
50 skills, TDD-validated, with an executable eval runner
v3.0.0 grows the library from 43 to 50 skills, re-templates every existing skill to one house format, and turns the evals from inert data into something a runner actually checks.
➕ 7 new skills (43 → 50)
Found via a multi-lens gap analysis + judge panel, then built through a research → author → review pipeline (the review stage caught a fabricated Jest fake-timers claim, a 16-digit secret-scan that would have flagged every legitimate test card, and several missing sections before they shipped):
Skill Category What it does test-case-managementProcess Manual/hybrid cases in TestRail/Xray/Zephyr/Qase — anatomy, bulk authoring from stories, ambiguous-step linting, CSV/API import-export, traceability test-suite-curationProcess Evidence-based regression-suite pruning — coverage fingerprinting, AST duplicate clustering, CI-history mining, smoke/core/extended tiering, quarantine-before-delete bug-reproductionAI-QA Vague report → verified minimal repro → failing regression test; git bisect, deterministic repro, red-before-fix agentic-browser-testingAI-QA Goal-driven E2E via a browser agent (Playwright MCP / computer-use) — determinism controls, cost budgets, accessibility-tree interaction, graduation to scripted tests email-testingSpecialized Signup/reset/magic-link/OTP flows via Mailpit/Mailosaur/MailSlurp — inbox polling, link/OTP extraction, deliverability checks payment-testingSpecialized Stripe (+ Adyen/Braintree/PayPal) sandboxes — test cards, 3DS/SCA iframes, test clocks, webhook signature/idempotency, refunds analytics-tracking-testingSpecialized GA4/dataLayer/pixel correctness — tracking-plan contract, beacon interception, param/value/timing assertions, Consent Mode v2, CI gating 🛡️ AI-agent / LLM security coverage
Prompted by a real indirect-prompt-injection payload disguised as a security finding:
security-testinggains an OWASP LLM Top 10 (2025) section and routes LLM-layer attacks toai-system-testing.ai-system-testinggains indirect-injection (tool output / RAG / scan reports), self-propagating directives, exfil-via-agent, and a defend-the-tester section.- Ships
skills/ai-system-testing/scripts/detect_injection.py— a self-tested scanner (10 attack-marker rule classes) plusreferences/injection-detector.md.
🔁 All 43 existing skills re-templated
Every
SKILL.mdbrought to one house format (docs/SKILL_TEMPLATE.md):<objective>, Discovery Questions, Core Principles, domain sections, Anti-Patterns, Verification, objectively-checkable Done When, Related Skills. Heavy code pushed intoreferences/. Currency pass on every named tool/version.✅ Evals are now executable
scripts/run_evals.py—--static(content proxy, CI-safe),--baseline(RED),--live(GREEN, viaclaude -p).- Extended
scripts/validate_skills.pyand a generatedscripts/build_index.py(skills_index.jsonhad drifted to v2.5.0). - A CI workflow runs the validator + static evals + index check + injection-detector selftest on every PR.
- Library health: validator 0 errors across 50 skills; static evals 92% checkable pass.
📚 Docs & site
README.md,CLAUDE.md,AGENTS.md, and the landing page updated to 50 skills with new disambiguation rules.docs/SKILL_TEMPLATE.mdis the new authoring contract.Install:
npx skills add petrkindlmann/qa-skills - v2.1.0v2.1.0 — 40 skills + QA Report Humanizer2026-03-23 · 2026-03-23 18:51 UTC
查看更新说明
New skill: qa-report-humanizer
Skill #40. Detects and rewrites AI patterns in QA reports, bug reports, test summaries, status updates, and stakeholder communications.
10 QA-specific anti-patterns with bad/better examples:
- Template openers that bury the signal
- Inflated severity language
- Pass rate obsession without context
- Generic risk language ("several high-risk areas require monitoring")
- PR review comments that say nothing
- Bug reports that start with the testing session instead of the bug
Format-specific guidance for test summaries, bug reports, sprint updates, Slack messages, and postmortems.
Other changes
- Humanized README and CONTRIBUTING copy (removed AI writing patterns)
- Landing page redesigned with split hero layout, terminal demo, hover effects, staggered animations
- Creator and project ecosystem visible earlier on landing page
- All references updated from 39 to 40 skills
用户点评
登录用户的真实使用记录，可按版本和硬件筛选共 0 条
还没有人点评。第一个说出真实体验的人最有价值。
QA Skills for AI Agents
QA and test automation skills for Claude Code, Codex, Cursor, Gemini CLI, VS Code, and other agents that support the Agent Skills Standard.
Website: qa-skills.com
npx skills add petrkindlmann/qa-skills
50 skills covering:
- Playwright and Cypress automation
- API, unit, and mobile testing
- Test strategy and risk-based planning
- CI/CD integration and test environments
- Accessibility, security, and compliance
- Visual regression and performance testing
- AI-assisted test generation, bug triage, and agentic browser testing
- Email, payment, and analytics-tracking testing
- Manual test-case management and regression-suite curation
- Chaos engineering, observability, and QA dashboards
Based on patterns from QA automation work across 6+ production sites.
Quick start
Option 1: Install specific skills (recommended)
npx skills add petrkindlmann/qa-skills playwright-automation test-strategy
Option 2: Clone the full repo
git clone https://github.com/petrkindlmann/qa-skills.git .skills/qa-skills
Option 3: Add as a git submodule
git submodule add https://github.com/petrkindlmann/qa-skills.git .skills/qa-skills
Option 4: Manual download
Download individual skill folders from skills/ and place them in your project's .skills/ directory.
Usage
Test the tests
The lab now holds 28 deliberate faults: 19 in the local Shop and 9 in pinned TodoMVC. The motion graphic illustrates the first run of that experiment, with 22 of them. See the application evidence, the current workflow report and the campaign-3 report for observations and limits.
Run checks and produce an evidence report
The full checkout also includes a local QA runner. Install its dependencies with npm ci,
then point it at your application:
npm run qa -- run --project /absolute/path/to/app --goal "Check the critical user flows"
It discovers the project's test command, recommends skills from the goal and repository,
runs bounded checks, and produces report.html, JSON evidence, and concise/detailed logs.
Missing tools, no observed tests, skipped work, and uninterpretable output remain visible.
The host agent uses the selected skills to author tests and make authorized repairs.
To make this part of future coding tasks, explicitly add the project instruction:
npm run qa -- init --project /absolute/path/to/app --wire-agent
This preserves the project's existing config and instructions. Activation depends on the
host reading its AGENTS.md; the runner does not install a background agent. For running
URLs, readiness selectors, CI artifacts, supported reporters, and execution limits, see
the QA runner guide. Installing individual skills does not install the CLI.
Use a domain skill
Ask your AI agent in natural language. Skill selection depends on the host agent; name a skill explicitly when a request could fit several. The examples below show the intended routing.
| You say | Skill activated |
|---|---|
| "Write Playwright tests for our checkout flow" | playwright-automation |
| "Create a QA strategy for this project" | test-strategy |
| "Generate tests from this PRD" | ai-test-generation |
| "This bug keeps happening in prod, classify and triage it" | ai-bug-triage |
| "Set up test reporting in GitHub Actions" | ci-cd-integration + qa-metrics |
| "What should we test before this release?" | release-readiness |
| "Run a visual regression check on the homepage" | visual-testing |
| "Load test our API with 1000 concurrent users" | performance-testing |
| "Check our app for OWASP Top 10 vulnerabilities" | security-testing |
| "Set up synthetic monitoring for critical flows" | synthetic-monitoring |
Skill categories
50 skills across 10 categories. Each skill keeps a lean SKILL.md (heavy code offloaded to references/, loaded on demand) with cross-references to related skills.
Foundation (3)
qa-project-context · qa-start · qa-do — project context template every other skill reads first, new-project QA bootstrap, and the last-resort skill router
Strategy (4)
test-strategy · test-planning · risk-based-testing · exploratory-testing — QA strategy, sprint/release test plans, risk-based prioritization, session-based exploratory testing
Automation (8)
playwright-automation · cypress-automation · selector-drift-recovery · api-testing · unit-testing · mobile-testing · visual-testing · performance-testing — Playwright E2E, Cypress component/E2E, bulk post-refactor selector regeneration, REST/GraphQL, Jest/Vitest/pytest, Appium/Detox, visual regression, k6 load testing and Lighthouse CI
Specialized (7)
accessibility-testing · security-testing · cross-browser-testing · database-testing · email-testing · payment-testing · analytics-tracking-testing — WCAG compliance, OWASP Top 10 + LLM, analytics-driven browser matrices, migration testing, email-flow capture, Stripe/PSP checkout and 3DS, GA4/pixel tracking correctness
AI-augmented QA (6)
ai-test-generation · ai-bug-triage · test-reliability · ai-qa-review · bug-reproduction · agentic-browser-testing — LLM test generation, automated bug triage, flaky test management, test quality review, report-to-failing-test reproduction, goal-driven agentic browser testing
Infrastructure (5)
ci-cd-integration · test-environments · test-data-management · contract-testing · service-virtualization — CI/CD pipelines, environment strategy, data factories, Pact consumer-driven contracts, WireMock/MSW
Metrics (3)
qa-metrics · qa-dashboard · coverage-analysis — quality gates and KPIs, Allure/Grafana/ReportPortal dashboards, coverage-as-ratchet in CI
Process (8)
shift-left-testing · qa-project-bootstrap · release-readiness · quality-postmortem · compliance-testing · qa-report-humanizer · test-case-management · test-suite-curation — shift-left patterns, QA onboarding, go/no-go checklists, blameless postmortems, GDPR/CMP compliance, QA report humanization, manual test-case authoring, regression-suite pruning
Production and observability (3)
testing-in-production · synthetic-monitoring · observability-driven-testing — feature flag validation, scheduled synthetic probes, trace-based test assertions
Knowledge and migration (3)
ai-system-testing · chaos-engineering · test-migration — LLM/AI feature testing, controlled fault injection, framework migration guides (Selenium/Cypress/Jest to modern stacks)
Full skills table
| Skill | Description | Category |
|---|---|---|
qa-project-context | Project context template covering tech stack, test frameworks, CI/CD, environments, quality goals. Every other skill reads this first. | Foundation |
qa-start | Bootstrap QA on a project that has none: chains qa-project-context, test-strategy and test-planning in one guided run, then executes the available checks and records evidence. | Foundation |
qa-do | Last-resort router: maps a plain-language QA situation to the next one or two skills and carries out the workflow with evidence. Used only when no other skill's triggers match. | Foundation |
test-strategy | QA strategy creation with risk-based prioritization, test pyramid design, entry/exit criteria, and tool selection rationale. | Strategy |
test-planning | Sprint and release test plans. Feature decomposition, requirements-to-test mapping, effort estimation, resource allocation. | Strategy |
risk-based-testing | Risk assessment matrices, priority-based test selection, impact/likelihood analysis, regression risk scoring. | Strategy |
exploratory-testing | Session-Based Test Management (SBTM), charter writing, heuristic-based exploration (HICCUPS, FEW HICCUPS), debrief templates. | Strategy |
playwright-automation | Playwright E2E testing. Page Object Model, fixtures, parallel execution, API mocking, visual comparisons, CI integration. | Automation |
cypress-automation | Cypress test suites with component testing, E2E testing, custom commands, cy.intercept, Cypress Cloud, and TypeScript support. | Automation |
selector-drift-recovery | Bulk-regenerate broken test selectors after a UI refactor. Snapshot old vs new DOM, map locators with confidence scores, ship a single PR. | Automation |
api-testing | REST and GraphQL testing with Playwright APIRequestContext or Supertest: Zod 4/AJV schemas (exact key sets when no schema library is installed), auth flows, CRUD, errors and headers, pagination. Every contract clause gets a test or a "not covered" line. | Automation |
unit-testing | Jest, Vitest, and pytest patterns. Mocking strategies, coverage thresholds, snapshot testing, test doubles taxonomy. | Automation |
mobile-testing | Native, React Native, hybrid and Flutter apps with Appium 3.x, Detox, Maestro and Patrol. Device farms, gestures, deep links and cold starts, push notifications, biometrics, poor-network simulation. | Automation |
visual-testing | Visual regression testing with Playwright screenshots, Chromatic, Percy, and Argos CI. Baseline management, diff thresholds, dynamic content masking. | Automation |
performance-testing | k6 load/stress/soak scripts, Lighthouse CI for Web Vitals, performance budgets as CI gates. | Automation |
accessibility-testing | WCAG 2.2 AA testing with axe-core and Playwright, keyboard and screen-reader audits, ARIA pattern checks, and legal mapping (ADA, EAA, Section 508). Automated and manual testing together. | Specialized |
security-testing | OWASP Top 10 (2025) in CI: ZAP DAST, OSV-Scanner and SBOM supply-chain checks, Semgrep SAST, auth and session tests (JWT, OAuth, RBAC), XSS/CSRF/SQLi/SSRF Playwright patterns. | Specialized |
cross-browser-testing | Analytics-driven browser test matrices, BrowserStack/Sauce Labs configuration, Playwright browser channels, common rendering issues. | Specialized |
database-testing | Database integrity validation, migration testing (forward/backward), schema constraints, seed data management, query performance. | Specialized |
ai-test-generation | Generate tests from specs, PRDs, and user stories using a staged pipeline with guardrails. Coverage matrix before code. | AI-QA |
ai-bug-triage | Classify bugs by severity/component/root cause. Deduplicate issues, analyze CI failures, generate tickets. | AI-QA |
test-reliability | Locator resilience, flaky test classification by root cause, quarantine management, confidence-scored auto-repair. | AI-QA |
ai-qa-review | Review existing test code across six smell dimensions (readability, reliability, diagnostic value, design, AI-generated, coverage), testability analysis, and mutation testing to back the findings. | AI-QA |
ci-cd-integration | GitHub Actions and GitLab CI pipeline templates. Parallelism, artifact management, flaky test quarantine, test result publishing. | Infrastructure |
test-environments | Environment strategy for dev, staging, preview, and production. Docker Compose, seed data, environment parity, cleanup. | Infrastructure |
test-data-management | Test data with factories, fixtures, synthetic data generation, database seeding, data cleanup, environment isolation. | Infrastructure |
contract-testing | Consumer-driven contract testing with Pact.js. Consumer tests, provider verification, Pact Broker, can-i-deploy gates. | Infrastructure |
service-virtualization | Dependency isolation decision framework. Mocks, stubs, fakes, record-replay, WireMock, MSW (Mock Service Worker). | Infrastructure |
qa-metrics | QA metrics with formulas: coverage %, flakiness rate, defect escape rate, MTTR, test execution trends, quality gates. | Metrics |
qa-dashboard | QA dashboards with Allure Report, Grafana, and ReportPortal. Test execution visualization, trend analysis, stakeholder reports. | Metrics |
coverage-analysis | Coverage measurement with Istanbul/V8/c8/coverage.py. Gap analysis, coverage-as-ratchet in CI, meaningful vs vanity coverage. | Metrics |
shift-left-testing | Move quality earlier. Dev/QA pairing, Three Amigos, TDD facilitation, PR review checklists, pre-merge quality gates. | Process |
qa-project-bootstrap | Onboard a QA engineer to an existing codebase. First 30 days checklist, test architecture audit, framework walkthrough, mentorship patterns. | Process |
release-readiness | Go/no-go checklists, smoke test suite design, rollback criteria, staged rollout validation, release sign-off. | Process |
quality-postmortem | Blameless postmortems for escaped defects. Bug pattern analysis, 5 Whys root cause analysis, test gap identification. | Process |
compliance-testing | Regulatory compliance testing. GDPR/CMP consent flows, Google Consent Mode v2, Global Privacy Control and US state opt-outs, EU AI Act Article 50 transparency, Better Ads Standards, cookie inventories. | Process |
qa-report-humanizer | Remove AI patterns from QA reports, bug reports, test summaries, and status updates. Makes QA writing sound like a real engineer wrote it. | Process |
testing-in-production | Production validation with feature flags, progressive rollouts, canary analysis, guardrail metrics, production smoke tests. | Production |
synthetic-monitoring | Post-deploy validation via scheduled synthetic tests. Probe design for critical user journeys, alert thresholds, SLA tracking. | Production |
observability-driven-testing | Use traces, logs, and telemetry as test evidence. OpenTelemetry integration, trace-based assertions, log-informed test design. | Production |
ai-system-testing | Test AI features in your product. Prompt regression, tool-call validation, hallucination and RAG grounding checks, nondeterministic output, red-team scans, indirect prompt injection. | Knowledge |
chaos-engineering | Controlled fault injection. Hypothesis-driven chaos experiments, network/service/infrastructure failure injection, blast radius control. | Knowledge |
test-migration | Incremental test suite migration. Selenium to Playwright, Cypress to Playwright, Jest to Vitest, Mocha to Vitest, Protractor to Playwright, with a coverage-parity track. | Knowledge |
test-case-management | Author and maintain manual/hybrid test cases in TestRail, Xray, Zephyr, Qase. Case anatomy, bulk authoring from stories, ambiguous-step linting, CSV/API import-export, traceability. | Process |
test-suite-curation | Audit and prune a regression suite with evidence: coverage fingerprinting, AST duplicate clustering, CI-history mining, smoke/core/extended tiering, quarantine-before-delete. | Process |
bug-reproduction | Turn a vague bug report into a verified minimal reproduction and a failing regression test. Reproduce-minimize-isolate-capture, git bisect, deterministic repro, red-before-fix. | AI-QA |
agentic-browser-testing | Goal-driven E2E via a browser agent (Playwright MCP / computer-use). Determinism controls, cost/latency budgets, accessibility-tree interaction, graduation to scripted tests. | AI-QA |
email-testing | End-to-end email-flow testing: signup, password reset, magic-link, OTP/MFA. Mailpit/Mailosaur/MailSlurp capture, inbox polling, link/OTP extraction, deliverability checks. | Specialized |
payment-testing | Payment/checkout testing against PSP sandboxes. Stripe test cards, 3DS/SCA iframe handling, test clocks, webhook signature/idempotency, refunds — never real cards. | Specialized |
analytics-tracking-testing | Validate GA4/GTM dataLayer, pixels, and ad-tech tags fire correctly. Tracking-plan contract, beacon interception, param/value/timing assertions, Consent Mode v2, CI gating. | Specialized |
AI-augmented QA
Most QA skills repos stop at framework tutorials. This one also covers how AI agents can help with the testing itself.
| Skill | What it does |
|---|---|
ai-test-generation | Generate test cases from PRDs, specs, and user stories. Builds a coverage matrix before writing code. |
ai-bug-triage | Classify bugs by severity/component/root cause, deduplicate issues, analyze CI failures |
test-reliability | Per-test runtime healing: detect broken locators, score selector stability, quarantine flaky tests, classify root causes |
selector-drift-recovery | Bulk offline regeneration: snapshot old vs new DOM after a UI refactor, ship one PR with per-change evidence |
ai-qa-review | Test quality review. Coverage gap detection, test smell identification, testability analysis |
bug-reproduction | Turn a vague bug report into a verified minimal reproduction and a failing regression test, with git bisect for the introducing commit |
agentic-browser-testing | Goal-driven E2E: a browser agent explores through the accessibility tree within pinned, bounded runs, then graduates stable paths to scripted tests |
Compatibility
Works with any tool that supports the Agent Skills Standard.
| Agent | Support | Install method |
|---|---|---|
| Claude Code | Native | npx skills add or clone |
| OpenAI Codex | Native | Clone or submodule |
| Cursor | Native | Clone to .cursor/skills |
| Gemini CLI | Native | Clone or submodule |
| VS Code Copilot | Via instructions | Clone and reference in settings |
| OpenCode | Native | Clone or submodule |
| Windsurf | Native | Clone or submodule |
| Any Agent Skills-compatible tool | Standard | Clone or submodule |
Tools registry
Skills reference specific QA tools for implementation. The Tools Registry lists all supported tools with capabilities, MCP server availability, and integration guides.
Covered: test frameworks, reporting, visual testing, CI/CD, project management, security scanning, observability.
Reliability checks
Each report is dated and records what was run, what was observed and where the evidence stops. Later changes are listed in VERSIONS.md, not written back into the reports.
- Stress test, 2026-10-20: representative requests for all 50 skills, reproduced defects and executable regressions. Healthy controls sit next to malformed input, missing evidence, duplicate events, retries, delayed tracking, ambiguous selectors and deceptive prompt-injection text.
- Real application workflows, 2026-10-21: pinned official TodoMVC, a local HTTP/SQLite Shop and a real Mailpit SMTP server. Fresh agents author the suites, an independent review finds coverage gaps, and every suite runs healthy and against deliberately broken builds.
- Addons, 2026-10-21: accessibility, database, security and performance checks on the same applications, eight more faults, and macOS arm64 next to Linux.
- QA runner, 2026-10-21: the
qa plan | run | initCLI, and one fresh agent task that wrote the missing check and repaired a shipping-threshold bug in a controlled fixture. - Semantic judge, 2026-10-21:
scripts/judge_evals.pyasks a model whether each skill teaches each of the 808 semantic criteria that lexical matching defers, and accepts a "yes" only with a quote the skill actually contains. Its 15 findings became 8 skill repairs and 7 re-phrased criteria. - Campaign 3, 2026-10-21: ten more skills, each authoring a suite blind against the same applications. 34 of 36 matrix cases were established; the other two are recorded as limits.
- With and without, 2026-10-22: one Shop task given to
nine blind agents, three with four skills, three with only the agent rules, three with
neither. Every suite caught eight of the nine pre-registered faults. The ninth separated
the arms (three skills takes, one rules take, two bare takes), but its guidance entered
api-testingin the same commit that built the fault, so it is not evidence for the skills. On ten further faults the skills arm caught 15 of 30 against 16 and 18: its takes never tested two contract clauses outside their skills' subjects. On this task the skills made the suites more uniform and took longer; they did not raise detection.api-testingnow asks for a test or a "not covered" line for every contract clause.
The lab holds 28 deliberate faults, 19 in the Shop and 9 in TodoMVC. The CI gate,
npm run test:workflow-controls, runs the released suites healthy (36 tests) and under 22
of those faults, each of which must fail its designated assertion.
Run the local gates with Python 3.12+ and Node 24+ (Linux AMD64 or macOS arm64 for the application workflows):
python3 -m pip install -r requirements-dev.txt
python3 -m unittest discover -s tests -p 'test_*.py' -v
python3 scripts/validate_skills.py
python3 scripts/build_index.py --check
python3 scripts/run_evals.py --static --all --min-pass-rate 90
npm ci
npm test
npm run test:qa
npx playwright install --with-deps chromium
npm run test:browser
npm run workflow:setup
npm run test:workflows
npm run test:mailpit
npm run test:workflow-controls
npm run test:workflows and the controls matrix cover the released suites under
tests/workflows/generated/. The campaign-3 suites and the with-and-without takes are scored
separately: node tests/workflows/run-matrix.mjs campaign3 and
node tests/workflows/run-experiment.mjs <take>. The semantic judge
(python3 scripts/judge_evals.py --static --all) calls the claude CLI and costs tokens, so
it is not part of CI.
The example tests load functions from the actual Markdown code blocks, so changes to the instructions are tested. Browser cases use controlled local fixtures. CI runs these separately from static evaluation, which checks lexical content coverage and defers semantic criteria. A static score is not an agent success rate.
Skills still require the application's real contracts, data, environment and evidence. A passing local fixture does not establish production correctness, legal compliance, downstream ingestion or compatibility with every future tool and model version. Keep successful, failed, retried, skipped, blocked and unknown results distinct, and add a reproducing case when a new defect is found.
Project context
Every skill checks for .agents/qa-project-context.md before asking discovery questions. This file captures your project's QA setup: tech stack, test frameworks, CI/CD, environments, quality goals, risk areas, team structure.
Create it once using the qa-project-context skill. All other skills read it automatically.
Contributing
See CONTRIBUTING.md.
Star to follow new skills and updates.
License
MIT. See LICENSE.
This project is not affiliated with, endorsed by, or sponsored by Microsoft, Cypress, Grafana Labs, BrowserStack, Sauce Labs, or any other referenced vendor. Product names and brands are the property of their respective owners.