Root skill for Software Testing / QA engineers — aligned with ISTQB Foundation, Advanced (Test Analyst, Technical Test Analyst, Test Manager), and Agile Extension syllabi. Load when asked to help with any testing task: manual testing, exploratory testing, test design, writing automated tests, security testing, performance testing, reviewing test quality, planning test strategy, filing bug reports, or analyzing coverage. Delegates to sub-skills: qa/manual-test, qa/unit-test, qa/api-test, qa/e2e-test, qa/performance-test, qa/security-test, qa/test-review, qa/bug-report, qa/test-plan. Trigger phrases: "test", "QA", "quality", "coverage", "defect", "bug", "regression", "smoke test", "test plan", "test strategy", "exploratory", "ISTQB", "SDET", "automation".
Design and build test automation frameworks from scratch. Load when asked about automation architecture, framework design, test pyramid strategy, choosing between POM vs Screenplay pattern, data-driven or keyword-driven frameworks, setting up CI/CD pipelines for test automation, parallel execution, folder structure, or how to scale a test suite. Aligned with ISTQB CTAL-TAE v2.0 and CT-TAS v1.0. Trigger phrases: "automation framework", "framework architecture", "test pyramid", "how to structure tests", "CI pipeline for testing", "parallel testing", "POM vs Screenplay", "data-driven framework", "keyword-driven", "hybrid framework", "scale automation", "automation strategy", "framework from scratch", "test infrastructure".
Test REST and GraphQL APIs, database queries, and service contracts. Load when asked to test HTTP endpoints, validate response schemas, do contract testing, test authentication flows, test database interactions, or verify API error handling. Supports pytest+httpx, Jest+Supertest, RestAssured, Postman/Newman, Pact, and database testing (SQL, MongoDB). Includes field-level assertions, IDOR testing, rate limit testing, and mobile API patterns. Trigger phrases: "test the API", "API test", "HTTP test", "endpoint test", "contract test", "test the endpoint", "REST test", "GraphQL test", "Postman", "schema validation", "database test", "DB test", "RestAssured", "test service", "integration test API".
Write end-to-end browser tests and UI automation scripts. Load when asked to automate user flows, test UI interactions, write browser tests, or verify full-stack journeys. Supports Playwright (primary), Cypress, and Selenium WebDriver. Generates Page Object Model (POM) code, test fixtures, and CI configuration. Trigger phrases: "e2e test", "browser test", "automate user flow", "Playwright", "Cypress", "Selenium", "UI test", "end-to-end", "test the login flow", "automate this journey", "smoke test", "regression test".
Write performance, load, and stress tests for APIs and services. Load when asked to load test, stress test, benchmark, or performance test a service. Generates k6 scripts (primary), JMeter test plans, and Locust scripts. Provides patterns for spike testing, soak testing, breakpoint testing, and interpreting results. Trigger phrases: "load test", "performance test", "stress test", "benchmark", "k6", "JMeter", "Locust", "throughput", "latency", "RPS", "concurrent users", "response time", "SLA", "p95", "p99".
Plan and execute security testing for web applications and APIs. Load when asked to security test, find vulnerabilities, do penetration testing, test OWASP Top 10, check for injection, XSS, IDOR, broken authentication, or review code for security issues. Covers OWASP WSTG, OWASP Top 10, OWASP LLM Top 10, SAST/DAST tooling, and generates security test cases, vulnerability reports, and security checklists. Trigger phrases: "security test", "penetration test", "pentest", "OWASP", "SQL injection", "XSS", "vulnerability", "IDOR", "broken auth", "security review", "SAST", "DAST", "security scan", "threat model", "LLM security", "AI security".
Write unit tests and integration tests for any language or framework. Load when asked to write tests for a function, class, module, or service. Supports pytest, Jest, Vitest, JUnit 5, xUnit, RSpec, Go testing, Mocha, TestNG, and more. Generates test code with AAA pattern, mocking strategies, parameterized tests, snapshot tests, BDD-style tests, and coverage gap analysis. Includes anti-pattern detection and verification-before- completion gate. Trigger phrases: "write unit tests", "test this function", "add tests", "mock this dependency", "TDD", "integration test", "snapshot test", "test coverage", "component test", "SDET", "pytest", "Jest", "JUnit".
Create structured, reproducible bug reports for software defects. Load when asked to file a bug, report an issue, write a defect report, or document unexpected behavior. Generates complete bug reports with steps to reproduce, expected vs actual behavior, severity classification, environment details, and evidence. Also provides templates for Jira, GitHub Issues, and Linear. Trigger phrases: "report this bug", "file a bug", "write a bug report", "this is broken", "defect report", "issue template", "bug template", "document this issue", "create a ticket".