メニュー
Dedicated non-functional requirements analysis per ISO/IEC 25010 quality model covering performance, security, usability, reliability, maintainability, and portability.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | qa-nfr-analyst |
| description | Dedicated non-functional requirements analysis per ISO/IEC 25010 quality model covering performance, security, usability, reliability, maintainability, and portability. |
| output_dir | docs/nfr |
Analyze and document non-functional requirements (NFRs) per ISO/IEC 25010 quality characteristics. Transform stakeholder expectations into testable NFR specifications with measurable criteria, measurement methods, and acceptance thresholds.
| Characteristic | Sub-Characteristics |
|---|---|
| Performance Efficiency | Time behavior, resource utilization, capacity |
| Security | Confidentiality, integrity, non-repudiation, accountability, authenticity |
| Usability | Appropriateness recognizability, learnability, operability, user error protection, accessibility |
| Reliability | Maturity, availability, fault tolerance, recoverability |
| Maintainability | Modularity, reusability, analysability, modifiability, testability |
| Portability | Adaptability, installability, replaceability |
See references/iso-25010-model.md for full definitions and measurement examples.
For each characteristic, define:
| Characteristic | Testable Criterion | Measurement Method |
|---|---|---|
| Performance | p95 response time ≤ 500ms | k6/Locust load test |
| Security | No OWASP Top 10 findings | OWASP ZAP scan |
| Usability | WCAG 2.2 AA compliance | axe-core, manual audit |
| Reliability | 99.9% uptime | Monitoring over 30 days |
| Maintainability | Cyclomatic complexity ≤ 10 | SonarQube |
| Portability | Runs on Node 18+ | CI matrix build |
Use references/wcag-checklist.md for the full success criteria checklist.
Use references/owasp-wstg-baseline.md for baseline scenarios.
| Category | Coverage |
|---|---|
| Injection | SQL, NoSQL, OS, LDAP, XSS |
| Authentication | Credential strength, lockout, MFA |
| Session Management | Token handling, timeout, fixation |
| Access Control | IDOR, privilege escalation, CORS |
| Cryptography | TLS, hashing, key management |
| Error Handling | Stack traces, info disclosure |
Use this template for SLA definitions:
Response Time:
- p50: ≤ {value}ms
- p95: ≤ {value}ms
- p99: ≤ {value}ms
Throughput:
- Requests/second: ≥ {value}
- Concurrent users: ≥ {value}
Error Rate:
- Target: ≤ {value}%
- Under load: ≤ {value}%
Availability:
- Target: ≥ {value}% (e.g., 99.9%)
- Measurement window: 30 days rolling
Produce an NFR Specification Document with:
1. Introduction
- Purpose, scope, definitions
2. Quality Requirements by Characteristic
[NFR-PERF-001] Response Time
Criterion: API p95 ≤ 500ms
Measurement: Load test, k6
Target: 500ms
Environment: Staging, 100 concurrent users
[NFR-SEC-001] Injection Resistance
Criterion: No SQL/NoSQL injection
Measurement: OWASP ZAP, manual
Target: Zero findings
...
3. Accessibility (WCAG 2.2)
- Level: AA
- Checklist: [reference to wcag-checklist.md]
4. Security Baseline (OWASP WSTG)
- Scenarios: [reference to owasp-wstg-baseline.md]
5. SLA Summary
- Response time, throughput, availability
Can do (autonomous):
Cannot do (requires confirmation):
Will not do (out of scope):
| Symptom | Likely Cause | Fix |
|---|---|---|
| Vague NFRs ("fast", "secure") | Stakeholder language | Ask for quantifiable targets; suggest industry benchmarks |
| Conflicting targets | Multiple stakeholders | Use Sequential Thinking to decompose; flag for prioritization |
| Missing measurement method | Criterion not testable | Add tool/method (k6, ZAP, axe-core, etc.) |
| WCAG level unclear | Accessibility scope undefined | Default to AA; ask if AAA needed |
| OWASP scope too broad | Full WSTG is large | Use baseline scenarios; expand per risk assessment |
Master skill coordinating all QA skills through pipeline modes (full-cycle, docs-only, testcases-only, write-tests, report), formalized handoff chains, scheduler rules, and framework/language selection based on project context.
QA project memory with auto-update. Structured log of bugs, decisions, tests, regressions, environments. Automatically updated after every QA task. Archive system with searchable index for large projects. Trigger phrases (EN): "initialize memory", "init qa memory", "find known bug", "search memory", "show what was done", "check regressions", "memory status", "archive memory", "log a bug", "add decision", "memory summary", "what bugs do we know", "update memory", "show test log". Trigger phrases (UA): "ініціалізувати пам'ять", "знайти відомий баг", "пошук у пам'яті", "показати що було зроблено", "перевірити регресії", "статус пам'яті", "архівувати пам'ять", "залогувати баг", "додати рішення", "зведення пам'яті", "які баги відомі", "оновити пам'ять", "показати лог тестів", "що ми вирішили про", "які тестові середовища є".
Analyze OpenAPI/Swagger spec (JSON or YAML) against existing test files and generate an HTML coverage report with QA automation tasks. Use when user provides an OpenAPI spec file and wants to know test coverage status.
Generate accessibility tests for WCAG 2.2 compliance using axe-core, Pa11y, and Lighthouse with automated checks for ARIA patterns, keyboard navigation, color contrast, and screen reader support.
Manage and formalize API contracts from existing endpoints, swagger/JSON, network traffic, or developer interviews into OpenAPI specifications.
Autonomously explore live web applications using Playwright MCP to collect page structure, form fields, validation rules, API endpoints, and user flows for test case generation.