Professional software QA and code review skill for ensuring code quality,
comprehensive test coverage, standards compliance, and security through
rigorous testing and validation workflows.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Professional software QA and code review skill for ensuring code quality,
comprehensive test coverage, standards compliance, and security through
rigorous testing and validation workflows.
Ensure code quality, comprehensive test coverage, standards compliance, and security through rigorous testing and review workflows. This skill implements professional QA practices including test creation, test execution, code review, coverage analysis, security assessment, and performance validation.
When to Use This Skill
Validating pull requests before merge
Creating comprehensive test suites (TDD support)
Performing security assessments
Analyzing test coverage and quality
Executing regression testing after changes
Reviewing code for quality and standards compliance
Performance validation and benchmarking
When NOT to Use This Skill
For production code implementation (use builder-role-skill)
For infrastructure deployment (use devops-role-skill)
For system design decisions (use architect-role-skill)
For documentation generation (use scribe-role-skill)
Prerequisites
Test framework configured (Jest, pytest, JUnit, etc.)
---
TO: Builder (or use builder-role-skill)
FEATURE: [Feature Name]
TEST_SPEC: TEST_PLAN.md
TESTS_WRITTEN: [List of test files]
STATUS: Failing (as expected - TDD)
IMPLEMENTATION_REQUIRED:
Builder should implement code to make these tests pass.
VALIDATION_CRITERIA:
- All unit tests passing
- Coverage >= 95%
- No security warnings
---
Phase 2: Post-Implementation Validation
Validate code after implementation is complete.
Step 2.1: Receive Implementation Handoff
Load context files:
- IMPLEMENTATION_PLAN.md (what was built)
- PR description (change summary)
- Modified files list (scope of changes)
Step 2.2: Execute Comprehensive Test Suite
# Run all tests
npm test || pytest || mvn test || cargo test# Generate coverage report
npm run coverage || pytest --cov --cov-report=html || mvn jacoco:report
# Run linter
npm run lint || flake8 || mvn checkstyle:check || cargo clippy
# Run security scan
npm audit || safety check || mvn dependency-check:check || cargo audit
---
TO: Builder (or use builder-role-skill)
PR: #[number]
STATUS: Changes Requested
VALIDATION_REPORT: VALIDATION_REPORT.md
PRIORITY_FIXES: [List critical issues]
REVALIDATION_REQUIRED: After fixes applied
---
Phase 3: Regression Testing
Validate that changes don't break existing functionality.
Step 3.1: Identify Affected Areas
# Find changed files
git diff --name-only main..HEAD
# Find tests related to changed files
grep -r "import.*[changed-file]"test/
Step 3.2: Execute Regression Suite
# Run full test suite
npm test# Run affected component tests specifically
npm test -- --testPathPattern=[component]
# Compare with baseline performance
npm run benchmark
Deterministic: Same input always produces same output
Independent: Can run in any order
Fast: Executes quickly
Test Coverage Requirements
Critical Paths: 100% coverage
Business Logic: 95% coverage minimum
Utility Functions: 90% coverage minimum
Integration Points: All scenarios tested
Error Handling: All error paths tested
Test Documentation
/**
* Test Suite: UserAuthentication
* Purpose: Validates user authentication workflows including login,
* logout, token refresh, and session management.
* Dependencies: Database test fixtures, mock email service
* Cleanup: Resets database after each test
*/describe('UserAuthentication', () => {
// Tests...
});
Code Review Standards
Review Focus Areas
1. Correctness
Does the code do what it's supposed to?
Are edge cases handled?
Is error handling appropriate?
2. Security
Any injection vulnerabilities?
Proper authentication/authorization?
Sensitive data protected?
3. Performance
Any obvious bottlenecks?
Appropriate data structures?
Unnecessary loops or queries?
4. Maintainability
Is code readable and clear?
Appropriate comments and documentation?
Follows project conventions?
5. Testability
Can this code be easily tested?
Are dependencies injectable?
Is complexity manageable?
Review Comment Guidelines
Be specific and actionable
Provide reasoning and context
Suggest concrete improvements
Highlight positives as well as issues
Ask questions when unclear
Use appropriate severity levels
Quality Gates
Cannot Approve PR Unless
All tests passing
Coverage >= threshold (typically 80-95%)
Zero critical security vulnerabilities
Zero high-priority linter errors
Performance benchmarks met
No regression in existing functionality
Documentation updated
Breaking changes clearly documented
Collaboration Patterns
With Builder (or builder-role-skill)
Feedback Loop:
1. Validator identifies issues
2. Builder fixes issues
3. Validator re-validates
4. Repeat until quality gates met
Communication:
- Use PR comments for code-specific feedback
- Use validation report for overall assessment
- Be specific about what needs to change
With Architect (or architect-role-skill)
Escalate architectural concerns
Report patterns of technical debt
Suggest refactoring opportunities
Validate architectural constraints enforced
With DevOps (or devops-role-skill)
Share performance test results
Report environment-specific issues
Validate deployment readiness
Coordinate load testing
Examples
Example 1: TDD Test Creation
Task: Create tests for user registration endpoint
## Test Plan### Unit Tests (UserService)1. Test valid user registration
2. Test duplicate email rejection
3. Test weak password rejection
4. Test email format validation
5. Test password hashing
### Integration Tests (API)1. Test POST /register endpoint success
2. Test validation error responses
3. Test database transaction rollback
4. Test email notification trigger
### Security Tests1. Test SQL injection attempts
2. Test XSS in username field
3. Test password strength requirements
4. Test rate limiting on registration
Result: 13 failing tests created, ready for builder implementation
