qa-skills

QA Skills for AI Agents

QA and test automation skills for Claude Code, Codex, Cursor, Gemini CLI, VS Code, and other agents that support the Agent Skills Standard.

Website: qa-skills.com

npx skills add petrkindlmann/qa-skills

50 skills covering:

• Playwright and Cypress automation
• API, unit, and mobile testing
• Test strategy and risk-based planning
• CI/CD integration and test environments
• Accessibility, security, and compliance
• Visual regression and performance testing
• AI-assisted test generation, bug triage, and agentic browser testing
• Email, payment, and analytics-tracking testing
• Manual test-case management and regression-suite curation
• Chaos engineering, observability, and QA dashboards

Based on patterns from QA automation work across 6+ production sites.

---

Quick start

Option 1: Install specific skills (recommended)

npx skills add petrkindlmann/qa-skills playwright-automation test-strategy

Option 2: Clone the full repo

git clone https://github.com/petrkindlmann/qa-skills.git .skills/qa-skills

Option 3: Add as a git submodule

git submodule add https://github.com/petrkindlmann/qa-skills.git .skills/qa-skills

Option 4: Manual download

Download individual skill folders from skills/ and place them in your project's .skills/ directory.

---

Usage

Test the tests

The lab now holds 28 deliberate faults: 19 in the local Shop and 9 in pinned TodoMVC. The motion graphic illustrates the first run of that experiment, with 22 of them. See the application evidence, the current workflow report and the campaign-3 report for observations and limits.

Run checks and produce an evidence report

The full checkout also includes a local QA runner. Install its dependencies with npm ci, then point it at your application:

npm run qa -- run --project /absolute/path/to/app --goal "Check the critical user flows"

It discovers the project's test command, recommends skills from the goal and repository, runs bounded checks, and produces report.html, JSON evidence, and concise/detailed logs. Missing tools, no observed tests, skipped work, and uninterpretable output remain visible. The host agent uses the selected skills to author tests and make authorized repairs.

To make this part of future coding tasks, explicitly add the project instruction:

npm run qa -- init --project /absolute/path/to/app --wire-agent

This preserves the project's existing config and instructions. Activation depends on the host reading its AGENTS.md; the runner does not install a background agent. For running URLs, readiness selectors, CI artifacts, supported reporters, and execution limits, see the QA runner guide. Installing individual skills does not install the CLI.

Use a domain skill

Ask your AI agent in natural language. Skill selection depends on the host agent; name a skill explicitly when a request could fit several. The examples below show the intended routing.

You say	Skill activated
"Write Playwright tests for our checkout flow"	playwright-automation
"Create a QA strategy for this project"	test-strategy
"Generate tests from this PRD"	ai-test-generation
"This bug keeps happening in prod, classify and triage it"	ai-bug-triage
"Set up test reporting in GitHub Actions"	ci-cd-integration + qa-metrics
"What should we test before this release?"	release-readiness
"Run a visual regression check on the homepage"	visual-testing
"Load test our API with 1000 concurrent users"	performance-testing
"Check our app for OWASP Top 10 vulnerabilities"	security-testing
"Set up synthetic monitoring for critical flows"	synthetic-monitoring

---

Skill categories

50 skills across 10 categories. Each skill keeps a lean SKILL.md (heavy code offloaded to references/, loaded on demand) with cross-references to related skills.

Foundation (3)

qa-project-context · qa-start · qa-do — project context template every other skill reads first, new-project QA bootstrap, and the last-resort skill router

Strategy (4)

test-strategy · test-planning · risk-based-testing · exploratory-testing — QA strategy, sprint/release test plans, risk-based prioritization, session-based exploratory testing

Automation (8)

playwright-automation · cypress-automation · selector-drift-recovery · api-testing · unit-testing · mobile-testing · visual-testing · performance-testing — Playwright E2E, Cypress component/E2E, bulk post-refactor selector regeneration, REST/GraphQL, Jest/Vitest/pytest, Appium/Detox, visual regression, k6 load testing and Lighthouse CI

Specialized (7)

accessibility-testing · security-testing · cross-browser-testing · database-testing · email-testing · payment-testing · analytics-tracking-testing — WCAG compliance, OWASP Top 10 + LLM, analytics-driven browser matrices, migration testing, email-flow capture, Stripe/PSP checkout and 3DS, GA4/pixel tracking correctness

AI-augmented QA (6)

ai-test-generation · ai-bug-triage · test-reliability · ai-qa-review · bug-reproduction · agentic-browser-testing — LLM test generation, automated bug triage, flaky test management, test quality review, report-to-failing-test reproduction, goal-driven agentic browser testing

Infrastructure (5)

ci-cd-integration · test-environments · test-data-management · contract-testing · service-virtualization — CI/CD pipelines, environment strategy, data factories, Pact consumer-driven contracts, WireMock/MSW

Metrics (3)

qa-metrics · qa-dashboard · coverage-analysis — quality gates and KPIs, Allure/Grafana/ReportPortal dashboards, coverage-as-ratchet in CI

Process (8)

shift-left-testing · qa-project-bootstrap · release-readiness · quality-postmortem · compliance-testing · qa-report-humanizer · test-case-management · test-suite-curation — shift-left patterns, QA onboarding, go/no-go checklists, blameless postmortems, GDPR/CMP compliance, QA report humanization, manual test-case authoring, regression-suite pruning

Production and observability (3)

testing-in-production · synthetic-monitoring · observability-driven-testing — feature flag validation, scheduled synthetic probes, trace-based test assertions

Knowledge and migration (3)

ai-system-testing · chaos-engineering · test-migration — LLM/AI feature testing, controlled fault injection, framework migration guides (Selenium/Cypress/Jest to modern stacks)

---

Full skills table

Skill	Description	Category
qa-project-context	Project context template covering tech stack, test frameworks, CI/CD, environments, quality goals. Every other skill reads this first.	Foundation
qa-start	Bootstrap QA on a project that has none: chains qa-project-context, test-strategy and test-planning in one guided run, then executes the available checks and records evidence.	Foundation
qa-do	Last-resort router: maps a plain-language QA situation to the next one or two skills and carries out the workflow with evidence. Used only when no other skill's triggers match.	Foundation
test-strategy	QA strategy creation with risk-based prioritization, test pyramid design, entry/exit criteria, and tool selection rationale.	Strategy
test-planning	Sprint and release test plans. Feature decomposition, requirements-to-test mapping, effort estimation, resource allocation.	Strategy
risk-based-testing	Risk assessment matrices, priority-based test selection, impact/likelihood analysis, regression risk scoring.	Strategy
exploratory-testing	Session-Based Test Management (SBTM), charter writing, heuristic-based exploration (HICCUPS, FEW HICCUPS), debrief templates.	Strategy
playwright-automation	Playwright E2E testing. Page Object Model, fixtures, parallel execution, API mocking, visual comparisons, CI integration.	Automation
cypress-automation	Cypress test suites with component testing, E2E testing, custom commands, cy.intercept, Cypress Cloud, and TypeScript support.	Automation
selector-drift-recovery	Bulk-regenerate broken test selectors after a UI refactor. Snapshot old vs new DOM, map locators with confidence scores, ship a single PR.	Automation
api-testing	REST and GraphQL testing with Playwright APIRequestContext or Supertest: Zod 4/AJV schemas (exact key sets when no schema library is installed), auth flows, CRUD, errors and headers, pagination. Every contract clause gets a test or a "not covered" line.	Automation
unit-testing	Jest, Vitest, and pytest patterns. Mocking strategies, coverage thresholds, snapshot testing, test doubles taxonomy.	Automation
mobile-testing	Native, React Native, hybrid and Flutter apps with Appium 3.x, Detox, Maestro and Patrol. Device farms, gestures, deep links and cold starts, push notifications, biometrics, poor-network simulation.	Automation
visual-testing	Visual regression testing with Playwright screenshots, Chromatic, Percy, and Argos CI. Baseline management, diff thresholds, dynamic content masking.	Automation
performance-testing	k6 load/stress/soak scripts, Lighthouse CI for Web Vitals, performance budgets as CI gates.	Automation
accessibility-testing	WCAG 2.2 AA testing with axe-core and Playwright, keyboard and screen-reader audits, ARIA pattern checks, and legal mapping (ADA, EAA, Section 508). Automated and manual testing together.	Specialized
security-testing	OWASP Top 10 (2025) in CI: ZAP DAST, OSV-Scanner and SBOM supply-chain checks, Semgrep SAST, auth and session tests (JWT, OAuth, RBAC), XSS/CSRF/SQLi/SSRF Playwright patterns.	Specialized
cross-browser-testing	Analytics-driven browser test matrices, BrowserStack/Sauce Labs configuration, Playwright browser channels, common rendering issues.	Specialized
database-testing	Database integrity validation, migration testing (forward/backward), schema constraints, seed data management, query performance.	Specialized
ai-test-generation	Generate tests from specs, PRDs, and user stories using a staged pipeline with guardrails. Coverage matrix before code.	AI-QA
ai-bug-triage	Classify bugs by severity/component/root cause. Deduplicate issues, analyze CI failures, generate tickets.	AI-QA
test-reliability	Locator resilience, flaky test classification by root cause, quarantine management, confidence-scored auto-repair.	AI-QA
ai-qa-review	Review existing test code across six smell dimensions (readability, reliability, diagnostic value, design, AI-generated, coverage), testability analysis, and mutation testing to back the findings.	AI-QA
ci-cd-integration	GitHub Actions and GitLab CI pipeline templates. Parallelism, artifact management, flaky test quarantine, test result publishing.	Infrastructure
test-environments	Environment strategy for dev, staging, preview, and production. Docker Compose, seed data, environment parity, cleanup.	Infrastructure
test-data-management	Test data with factories, fixtures, synthetic data generation, database seeding, data cleanup, environment isolation.	Infrastructure
contract-testing	Consumer-driven contract testing with Pact.js. Consumer tests, provider verification, Pact Broker, can-i-deploy gates.	Infrastructure
service-virtualization	Dependency isolation decision framework. Mocks, stubs, fakes, record-replay, WireMock, MSW (Mock Service Worker).	Infrastructure
qa-metrics	QA metrics with formulas: coverage %, flakiness rate, defect escape rate, MTTR, test execution trends, quality gates.	Metrics
qa-dashboard	QA dashboards with Allure Report, Grafana, and ReportPortal. Test execution visualization, trend analysis, stakeholder reports.	Metrics
coverage-analysis	Coverage measurement with Istanbul/V8/c8/coverage.py. Gap analysis, coverage-as-ratchet in CI, meaningful vs vanity coverage.	Metrics
shift-left-testing	Move quality earlier. Dev/QA pairing, Three Amigos, TDD facilitation, PR review checklists, pre-merge quality gates.	Process
qa-project-bootstrap	Onboard a QA engineer to an existing codebase. First 30 days checklist, test architecture audit, framework walkthrough, mentorship patterns.	Process
release-readiness	Go/no-go checklists, smoke test suite design, rollback criteria, staged rollout validation, release sign-off.	Process
quality-postmortem	Blameless postmortems for escaped defects. Bug pattern analysis, 5 Whys root cause analysis, test gap identification.	Process
compliance-testing	Regulatory compliance testing. GDPR/CMP consent flows, Google Consent Mode v2, Global Privacy Control and US state opt-outs, EU AI Act Article 50 transparency, Better Ads Standards, cookie inventories.	Process
qa-report-humanizer	Remove AI patterns from QA reports, bug reports, test summaries, and status updates. Makes QA writing sound like a real engineer wrote it.	Process
testing-in-production	Production validation with feature flags, progressive rollouts, canary analysis, guardrail metrics, production smoke tests.	Production
synthetic-monitoring	Post-deploy validation via scheduled synthetic tests. Probe design for critical user journeys, alert thresholds, SLA tracking.	Production
observability-driven-testing	Use traces, logs, and telemetry as test evidence. OpenTelemetry integration, trace-based assertions, log-informed test design.	Production
ai-system-testing	Test AI features in your product. Prompt regression, tool-call validation, hallucination and RAG grounding checks, nondeterministic output, red-team scans, indirect prompt injection.	Knowledge
chaos-engineering	Controlled fault injection. Hypothesis-driven chaos experiments, network/service/infrastructure failure injection, blast radius control.	Knowledge
test-migration	Incremental test suite migration. Selenium to Playwright, Cypress to Playwright, Jest to Vitest, Mocha to Vitest, Protractor to Playwright, with a coverage-parity track.	Knowledge
test-case-management	Author and maintain manual/hybrid test cases in TestRail, Xray, Zephyr, Qase. Case anatomy, bulk authoring from stories, ambiguous-step linting, CSV/API import-export, traceability.	Process
test-suite-curation	Audit and prune a regression suite with evidence: coverage fingerprinting, AST duplicate clustering, CI-history mining, smoke/core/extended tiering, quarantine-before-delete.	Process
bug-reproduction	Turn a vague bug report into a verified minimal reproduction and a failing regression test. Reproduce-minimize-isolate-capture, git bisect, deterministic repro, red-before-fix.	AI-QA
agentic-browser-testing	Goal-driven E2E via a browser agent (Playwright MCP / computer-use). Determinism controls, cost/latency budgets, accessibility-tree interaction, graduation to scripted tests.	AI-QA
email-testing	End-to-end email-flow testing: signup, password reset, magic-link, OTP/MFA. Mailpit/Mailosaur/MailSlurp capture, inbox polling, link/OTP extraction, deliverability checks.	Specialized
payment-testing	Payment/checkout testing against PSP sandboxes. Stripe test cards, 3DS/SCA iframe handling, test clocks, webhook signature/idempotency, refunds — never real cards.	Specialized
analytics-tracking-testing	Validate GA4/GTM dataLayer, pixels, and ad-tech tags fire correctly. Tracking-plan contract, beacon interception, param/value/timing assertions, Consent Mode v2, CI gating.	Specialized

---

AI-augmented QA

Most QA skills repos stop at framework tutorials. This one also covers how AI agents can help with the testing itself.

Skill	What it does
ai-test-generation	Generate test cases from PRDs, specs, and user stories. Builds a coverage matrix before writing code.
ai-bug-triage	Classify bugs by severity/component/root cause, deduplicate issues, analyze CI failures
test-reliability	Per-test runtime healing: detect broken locators, score selector stability, quarantine flaky tests, classify root causes
selector-drift-recovery	Bulk offline regeneration: snapshot old vs new DOM after a UI refactor, ship one PR with per-change evidence
ai-qa-review	Test quality review. Coverage gap detection, test smell identification, testability analysis
bug-reproduction	Turn a vague bug report into a verified minimal reproduction and a failing regression test, with git bisect for the introducing commit
agentic-browser-testing	Goal-driven E2E: a browser agent explores through the accessibility tree within pinned, bounded runs, then graduates stable paths to scripted tests

---

Compatibility

Works with any tool that supports the Agent Skills Standard.

Agent	Support	Install method
Claude Code	Native	npx skills add or clone
OpenAI Codex	Native	Clone or submodule
Cursor	Native	Clone to .cursor/skills
Gemini CLI	Native	Clone or submodule
VS Code Copilot	Via instructions	Clone and reference in settings
OpenCode	Native	Clone or submodule
Windsurf	Native	Clone or submodule
Any Agent Skills-compatible tool	Standard	Clone or submodule

---

Tools registry

Skills reference specific QA tools for implementation. The Tools Registry lists all supported tools with capabilities, MCP server availability, and integration guides.

Covered: test frameworks, reporting, visual testing, CI/CD, project management, security scanning, observability.

---

Reliability checks

Each report is dated and records what was run, what was observed and where the evidence stops. Later changes are listed in VERSIONS.md, not written back into the reports.

• Stress test, 2026-10-20: representative requests for all 50 skills, reproduced defects and executable regressions. Healthy controls sit next to malformed input, missing evidence, duplicate events, retries, delayed tracking, ambiguous selectors and deceptive prompt-injection text.
• Real application workflows, 2026-10-21: pinned official TodoMVC, a local HTTP/SQLite Shop and a real Mailpit SMTP server. Fresh agents author the suites, an independent review finds coverage gaps, and every suite runs healthy and against deliberately broken builds.
• Addons, 2026-10-21: accessibility, database, security and performance checks on the same applications, eight more faults, and macOS arm64 next to Linux.
• QA runner, 2026-10-21: the qa plan | run | init CLI, and one fresh agent task that wrote the missing check and repaired a shipping-threshold bug in a controlled fixture.
• Semantic judge, 2026-10-21: scripts/judge_evals.py asks a model whether each skill teaches each of the 808 semantic criteria that lexical matching defers, and accepts a "yes" only with a quote the skill actually contains. Its 15 findings became 8 skill repairs and 7 re-phrased criteria.
• Campaign 3, 2026-10-21: ten more skills, each authoring a suite blind against the same applications. 34 of 36 matrix cases were established; the other two are recorded as limits.
• With and without, 2026-10-22: one Shop task given to nine blind agents, three with four skills, three with only the agent rules, three with neither. Every suite caught eight of the nine pre-registered faults. The ninth separated the arms (three skills takes, one rules take, two bare takes), but its guidance entered api-testing in the same commit that built the fault, so it is not evidence for the skills. On ten further faults the skills arm caught 15 of 30 against 16 and 18: its takes never tested two contract clauses outside their skills' subjects. On this task the skills made the suites more uniform and took longer; they did not raise detection. api-testing now asks for a test or a "not covered" line for every contract clause.

The lab holds 28 deliberate faults, 19 in the Shop and 9 in TodoMVC. The CI gate, npm run test:workflow-controls, runs the released suites healthy (36 tests) and under 22 of those faults, each of which must fail its designated assertion.

Run the local gates with Python 3.12+ and Node 24+ (Linux AMD64 or macOS arm64 for the application workflows):

python3 -m pip install -r requirements-dev.txt
python3 -m unittest discover -s tests -p 'test_*.py' -v
python3 scripts/validate_skills.py
python3 scripts/build_index.py --check
python3 scripts/run_evals.py --static --all --min-pass-rate 90
npm ci
npm test
npm run test:qa
npx playwright install --with-deps chromium
npm run test:browser
npm run workflow:setup
npm run test:workflows
npm run test:mailpit
npm run test:workflow-controls

npm run test:workflows and the controls matrix cover the released suites under tests/workflows/generated/. The campaign-3 suites and the with-and-without takes are scored separately: node tests/workflows/run-matrix.mjs campaign3 and node tests/workflows/run-experiment.mjs <take>. The semantic judge (python3 scripts/judge_evals.py --static --all) calls the claude CLI and costs tokens, so it is not part of CI.

The example tests load functions from the actual Markdown code blocks, so changes to the instructions are tested. Browser cases use controlled local fixtures. CI runs these separately from static evaluation, which checks lexical content coverage and defers semantic criteria. A static score is not an agent success rate.

Skills still require the application's real contracts, data, environment and evidence. A passing local fixture does not establish production correctness, legal compliance, downstream ingestion or compatibility with every future tool and model version. Keep successful, failed, retried, skipped, blocked and unknown results distinct, and add a reproducing case when a new defect is found.

---

Project context

Every skill checks for .agents/qa-project-context.md before asking discovery questions. This file captures your project's QA setup: tech stack, test frameworks, CI/CD, environments, quality goals, risk areas, team structure.

Create it once using the qa-project-context skill. All other skills read it automatically.

---

Contributing

See CONTRIBUTING.md.

Star to follow new skills and updates.

---

License

MIT. See LICENSE.

---

_{This project is not affiliated with, endorsed by, or sponsored by Microsoft, Cypress, Grafana Labs, BrowserStack, Sauce Labs, or any other referenced vendor. Product names and brands are the property of their respective owners.}