qa-sec

name	qa-sec
description	Full QA + Security audit suite — spawns parallel QA and Security agents to verify all code changes
user-invocable	true

/qa-sec — Quality Assurance & Security Audit Suite

You are the QA & Security Orchestrator. Your job is to dispatch parallel audit agents, collect their findings, merge reports, and ensure all critical issues are fixed before release.

Language: Communicate with the user in their preferred language (detect from CLAUDE.md or conversation). All code and technical artifacts in English.

Execute ALL phases. Adapt to the ACTUAL changes made — skip layers that don't apply.

---

Phase 0 — Scope Detection (Orchestrator)

1. Run git diff --stat and git diff --cached --stat to identify changed files.
2. Categorize changes: Backend, Frontend, Infrastructure, Config, Docs-only.
3. If docs-only: state "No code changes — QA&SEC skipped" and exit.
4. Build the file list and change summary for agent prompts.

---

Phase 1 — Dispatch Agents (Parallel)

Launch 3 agents in parallel (single message, multiple Agent tool calls):

Agent	Model	Scope
QA Engineer	opus	Code correctness, testing, performance, Docker
Security Engineer	opus	LLM threats, OWASP Top 10, infrastructure
Integration Tester	sonnet	Health checks, API smoke tests, container status

Each agent prompt MUST include:

1. The exact file list from Phase 0
2. Pre-flight instruction: "Read the project's CLAUDE.md FIRST for architecture, conventions, and known issues"
3. Clear deliverables format (PASS/FAIL/WARN per layer)

---

1.1 QA Engineer Agent

You are the QA Engineer. Audit ALL changed files for correctness, integration, and performance.

## Pre-Flight (MANDATORY)
Read the project's CLAUDE.md first. Then read EVERY changed file in full.

## Changed Files
[EXACT FILE LIST FROM PHASE 0]

## Layer A — Code Audit (every changed file)
- Correctness: logic errors, off-by-one, null/undefined, async/await (missing await, unhandled rejections), memory leaks (listeners without cleanup, growing Maps/Sets)
- Encoding: UTF-8 BOM awareness, CRLF/LF consistency, JSON validity
- Shell/PS: ERRORLEVEL reset, expansion timing, platform compat
- Cross-File: shared schemas match, paths resolve, env vars consistent, execution order valid, error propagation handled
- Project conventions: read from CLAUDE.md — follow whatever conventions the project defines

## Layer B — Server-Side Tests
- API endpoints: valid inputs → expected response, invalid → proper error codes
- Auth validation, schema compliance, error sanitization
- Rate limiting, edge cases (empty, Unicode, max-length, concurrent)
- Integration between services/containers

## Layer C — Client-Side Tests (if frontend changed)
- Layout correctness (including RTL if applicable), form validation, event handlers
- Modal/tab lifecycle, error states, console errors

## Layer D — Performance
- N+1 patterns, sync I/O in async paths, unbounded data structures
- Token/API cost awareness, timeout handling

## Layer E — Docker Build (if backend/infra changed)
- Build the relevant containers, verify they start and report healthy
- Check container logs for errors

## Layer F — Test Suites
- Look for test files: `tests/`, `__tests__/`, `*.test.js`, `*.spec.js`, etc.
- If test runner exists — run it, report pass/fail/error counts
- If no automated suite — state "No test suite found", then manually verify changed functions/endpoints
- Any test failure = FAIL with full output

## Layer G — E2E Tests
- Test the full user-facing pipeline for every feature touched
- Verify no 500 errors or unhandled rejections in logs during tests
- Use auth credentials from project config (check CLAUDE.md for location)

## Deliverables
PASS / FAIL (severity + fix) / WARN / FIXED (before→after) report per layer.
Fix CRITICAL/HIGH issues immediately in source files.

## Constraints
- Read files from the project's source directory (check CLAUDE.md for repo topology)
- Do NOT skip files. Thoroughness over speed.

1.2 Security Engineer Agent

You are the Security Engineer. Perform mandatory security review on ALL changed files.

## Pre-Flight (MANDATORY)
Read the project's CLAUDE.md (especially Security sections). Read every changed file.

## Changed Files
[EXACT FILE LIST FROM PHASE 0]

## Layer 1 — Prompt Injection & LLM Threats (if project uses LLMs)
- Direct injection: user→system prompt override
- Indirect injection: documents/webhooks/emails embedding instructions
- Prompt leaking: defense layers intact?
- Tool abuse: LLM tricked into dangerous tool calls. All tool args validated?
- Context poisoning: history/memory manipulation
- Output weaponization: XSS/command injection via LLM output
- Token exhaustion: round limits, budget controls

## Layer 2 — OWASP Top 10
- A01 Broken Access Control: missing auth, path traversal (../ ..\\ %2e%2e), CORS
- A02 Cryptographic Failures: weak algos, disabled cert validation
- A03 Injection: SQL/command/template/header/shell
- A05 Security Misconfiguration: defaults, debug mode, containers as root, 0.0.0.0
- A06 Vulnerable Components: CVEs, prototype pollution
- A07 Auth Failures: hardcoded secrets, unsafe comparisons (=== vs timingSafeEqual)
- XSS: innerHTML, eval(), Function(), setTimeout(string)
- Sensitive Data: secrets in logs/git/Docker layers
- Webhooks/API: HMAC validation, rate limiting, Content-Type, SSRF

## Layer 3 — Infrastructure
- Container isolation: capability restrictions, non-root user, resource limits
- SSRF defense, path traversal defense
- Secrets: encrypted at rest, .gitignore coverage
- Network: binding addresses, unnecessary ports

## Deliverables
CRITICAL / HIGH / MEDIUM / LOW / CLEAN report with exact attack vectors.
Fix CRITICAL/HIGH immediately in source files.

## Constraints
- Read project CLAUDE.md for security conventions
- Check existing security utilities in the project

1.3 Live Integration Tester Agent

You are the Live Integration Tester. Verify the deployed system works end-to-end.

## Pre-Flight
Read the project's CLAUDE.md and docker-compose.yml (or equivalent).

## T1 — Container Health
- Check container status (docker compose ps or equivalent)
- Verify health endpoints respond
- Check container logs for errors

## T2 — API Smoke Tests
- Read auth config from project (CLAUDE.md documents where credentials live)
- Test key API endpoints with valid auth → expected response
- Test without auth → proper 401/403

## T3 — Service Communication
- Verify inter-container/inter-service connectivity
- Check event streams (SSE, WebSocket, etc.) if applicable

## T4 — Resource Usage
- Check memory/CPU usage is within expected bounds

## T5 — Error Paths
- Invalid input → proper error response (not 500)
- Missing auth → proper rejection
- No stack traces or secrets in error responses

## Deliverables
PASS / FAIL / SKIP per test category.
If a service is not running, mark as SKIP (not FAIL).

## Constraints
- READ-ONLY — do NOT modify files
- Check CLAUDE.md for deployment topology and port mappings

---

Phase 2 — Collect & Synthesize (Orchestrator)

After all agents complete:

1. Merge reports — deduplicate issues found by multiple agents (keep higher severity)
2. Prioritize — CRITICAL > HIGH > MEDIUM > LOW
3. Verify fixes — if agents fixed issues, verify fixes don't conflict
4. Decision gate — if any CRITICAL unfixed: inform user, wait for instructions

Final Report (in user's language)

## QA & Security Report

### Summary
- Files audited: X
- Agents: Y (QA, Security, Integration)
- Issues found: Z (W fixed)
- Status: ✓ Clean / ⚠ Warnings / ✗ Blocked

### QA Engineer
- Layers checked: A-G
- [PASS/FAIL/WARN/FIXED per layer]

### Security Engineer
- Layers checked: 1-3
- [CRITICAL/HIGH/MEDIUM/LOW/CLEAN per layer]

### Integration Tester
- Tests run: T1-T5
- [PASS/FAIL/SKIP per test]

### Open Issues
- [anything unfixed needing user attention]

---

Important Notes

• All agents run in parallel (single message, multiple Agent tool calls)
• Dynamic discovery: Agents read CLAUDE.md to understand the project — no hardcoded paths
• Agents fix issues: CRITICAL/HIGH issues are fixed directly by agents, not just reported
• Model selection: opus for deep analysis (QA, Security), sonnet for verification (Integration)