メニュー
Professional software QA and code review skill for ensuring code quality, comprehensive test coverage, standards compliance, and security through rigorous testing and validation workflows.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/enuno/claude-command-and-control --skill validator-role-skillコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | validator-role-skill |
| version | 1.0.0 |
| category | quality-assurance |
| complexity | moderate |
| status | active |
| created | 2025-12-12T00:00:00.000Z |
| author | claude-command-and-control |
| description | Professional software QA and code review skill for ensuring code quality, comprehensive test coverage, standards compliance, and security through rigorous testing and validation workflows. |
| triggers | ["validate code","review pull request","create tests","run quality checks","security review"] |
| dependencies | [] |
| tags | ["testing","code-review","quality-assurance","security","tdd"] |
Ensure code quality, comprehensive test coverage, standards compliance, and security through rigorous testing and review workflows. This skill implements professional QA practices including test creation, test execution, code review, coverage analysis, security assessment, and performance validation.
Support test-driven development by creating tests before implementation.
Step 1.1: Review Feature Specification
Load context files:
- DEVELOPMENT_PLAN.md (overall plan)
- ARCHITECTURE.md (design specs)
- IMPLEMENTATION_PLAN.md (implementation details)
Step 1.2: Create Test Specification
Generate TEST_PLAN.md with comprehensive test strategy:
# Test Plan: [Feature Name]
## Test Strategy
- Unit Test Coverage Target: 95%
- Integration Test Coverage: All public APIs
- E2E Test Coverage: Critical user paths
- Performance Benchmarks: [Specific targets]
## Test Categories
### Unit Tests
**Component**: [Name]
- Test 1: [Scenario] - Expected: [Result]
- Test 2: [Scenario] - Expected: [Result]
Test 3: [Edge case] - Expected: [Error handling]
: [Name]
Test 1: [Interaction scenario]
Test 2: [Data flow validation]
Test 3: [Error propagation]
: [Name]
Test 1: [Happy path]
Test 2: [Alternate path]
Test 3: [Error scenarios]
[Fixtures, mocks, test databases needed]
Response time: < [X]ms
Throughput: > [Y] requests/sec
Memory usage: < [Z]MB
[ ] Input validation
[ ] SQL injection protection
[ ] XSS prevention
[ ] Authentication bypass attempts
[ ] Authorization boundary tests
Step 1.3: Write Failing Tests First
// Example: Jest/JavaScript
describe('UserService', () => {
describe('createUser', () => {
it('should create user with valid data', async () => {
// Arrange
const userData = {
email: 'test@example.com',
password: 'SecurePass123!'
};
// Act
const result = await userService.createUser(userData);
// Assert
expect(result).toHaveProperty('id');
expect(result.email).toBe(userData.email);
expect(result.password).not.toBe(userData.password); // hashed
});
it('should reject invalid email format', async () => {
// Arrange
const userData = {
email: 'invalid-email',
password: 'SecurePass123!'
};
// Act & Assert
await expect(userService.createUser(userData))
.rejects.toThrow('Invalid email format');
});
it('should reject weak password', async () => {
// Arrange
const userData = {
email: 'test@example.com',
password: '123'
};
// Act & Assert
await expect(userService.createUser(userData))
.rejects.toThrow('Password does not meet security requirements');
});
});
});
Step 1.4: Handoff to Builder
---
TO: Builder (or use builder-role-skill)
FEATURE: [Feature Name]
TEST_SPEC: TEST_PLAN.md
TESTS_WRITTEN: [List of test files]
STATUS: Failing (as expected - TDD)
IMPLEMENTATION_REQUIRED:
Builder should implement code to make these tests pass.
VALIDATION_CRITERIA:
- All unit tests passing
- Coverage >= 95%
- No security warnings
---
Validate code after implementation is complete.
Step 2.1: Receive Implementation Handoff
Load context files:
- IMPLEMENTATION_PLAN.md (what was built)
- PR description (change summary)
- Modified files list (scope of changes)
Step 2.2: Execute Comprehensive Test Suite
# Run all tests
npm test || pytest || mvn test || cargo test
# Generate coverage report
npm run coverage || pytest --cov --cov-report=html || mvn jacoco:report
# Run linter
npm run lint || flake8 || mvn checkstyle:check || cargo clippy
# Run security scan
npm audit || safety check || mvn dependency-check:check || cargo audit
Step 2.3: Analyze Results
Create VALIDATION_REPORT.md:
# Validation Report: [Feature/PR Name]
## Test Execution Results
- Total Tests: [N]
- Passing: [N]
- Failing: [N]
- Skipped: [N]
- Duration: [X]s
## Coverage Analysis
- Overall Coverage: [X]%
- Line Coverage: [X]%
- Branch Coverage: [X]%
- Function Coverage: [X]%
**Coverage by Component**:
| Component | Coverage | Status |
|-----------|----------|--------|
| [Name] | [X]% | ✅ / ⚠️ / ❌ |
**Uncovered Areas**:
- File: [name], Lines: [X-Y] - Reason: [Why not covered]
## Code Quality
- Linting Issues: [N]
- Code Smells: [N]
- Complexity Warnings: [N]
- Duplication: [X]%
## Security Assessment
- Vulnerabilities Found: [N]
- Severity: [Critical/High/Medium/Low]
- Affected Packages: [List]
## Performance Validation
- Response Time: [X]ms (Target: <[Y]ms) ✅ / ❌
- Memory Usage: [X]MB (Target: <[Y]MB) ✅ / ❌
- Throughput: [X] req/s (Target: >[Y]) ✅ / ❌
## Overall Assessment
**Status**: ✅ APPROVED / ⚠️ APPROVED WITH CONCERNS / ❌ REJECTED
**Justification**:
[Detailed reasoning for decision]
Step 2.4: Code Review
Add inline review comments to PR:
## Code Review Comments
### Critical Issues (Must Fix)
1. **File: [name], Line: [X]**
- Issue: [Description]
- Impact: [Security/Functionality/Performance]
- Recommendation: [How to fix]
### Suggestions (Should Consider)
1. **File: [name], Line: [X]**
- Observation: [What could be improved]
- Recommendation: [Alternative approach]
- Benefit: [Why it's better]
### Positive Highlights
1. **File: [name]**
- Excellent: [What was done well]
### Questions
1. **File: [name], Line: [X]**
- Question: [What's unclear]
- Context: [Why asking]
Step 2.5: Decision and Handoff
If APPROVED:
# Add approval comment to PR
gh pr review [PR-number] --approve --body "$(cat VALIDATION_REPORT.md)"
# Update status
echo "✅ Validation complete - APPROVED" >> MULTI_AGENT_PLAN.md
If REJECTED:
# Request changes
gh pr review [PR-number] --request-changes --body "$(cat VALIDATION_REPORT.md)"
Handoff back to Builder:
---
TO: Builder (or use builder-role-skill)
PR: #[number]
STATUS: Changes Requested
VALIDATION_REPORT: VALIDATION_REPORT.md
PRIORITY_FIXES: [List critical issues]
REVALIDATION_REQUIRED: After fixes applied
---
Validate that changes don't break existing functionality.
Step 3.1: Identify Affected Areas
# Find changed files
git diff --name-only main..HEAD
# Find tests related to changed files
grep -r "import.*[changed-file]" test/
Step 3.2: Execute Regression Suite
# Run full test suite
npm test
# Run affected component tests specifically
npm test -- --testPathPattern=[component]
# Compare with baseline performance
npm run benchmark
Step 3.3: Document Regression Results
# Regression Test Report: [Date]
## Changes Analyzed
- [File 1]: [Type of change]
- [File 2]: [Type of change]
## Tests Executed
- Total regression tests: [N]
- New failures: [N]
- Fixed issues: [N]
## Regression Detected
**None** / **Issues Found**:
1. **Test**: [Name]
- Previous: PASS
- Current: FAIL
- Root Cause: [Analysis]
- Action: [Revert / Fix / Accept]
## Recommendation
✅ Safe to proceed / ❌ Revert changes / ⚠️ Proceed with caution
Perform comprehensive security assessment.
Step 4.1: Security Checklist Review
# Security Validation Checklist: [Feature]
## Input Validation
- [ ] All user inputs validated
- [ ] Type checking implemented
- [ ] Length/size limits enforced
- [ ] Special characters sanitized
- [ ] SQL injection protected
- [ ] XSS prevention in place
## Authentication & Authorization
- [ ] Authentication required on protected routes
- [ ] Authorization verified for each action
- [ ] Session management secure
- [ ] Token expiration handled
- [ ] Password storage uses strong hashing
## Data Protection
- [ ] Sensitive data encrypted at rest
- [ ] TLS/HTTPS for data in transit
- [ ] No secrets in code or logs
- [ ] PII handling compliant
- [ ] Data access properly logged
## API Security
- [ ] Rate limiting implemented
- [ ] CORS configured correctly
- [ ] API keys secured
- [ ] Error messages don't leak info
- [ ] No verbose errors in production
## Dependencies
- [ ] No known vulnerable packages
- [ ] Dependencies up to date
- [ ] License compliance verified
Step 4.2: Penetration Testing
# Run security scanner
npm audit --audit-level=moderate
safety check
snyk test
# SQL injection test cases
npm test -- --testNamePattern="SQL injection"
# XSS test cases
npm test -- --testNamePattern="XSS"
Step 4.3: Security Report
# Security Assessment: [Feature]
## Vulnerabilities Found: [N]
### Critical
- None / [List with CVE numbers]
### High
- None / [List with CVE numbers]
### Medium
- None / [List with CVE numbers]
### Low
- None / [List with CVE numbers]
## Remediation Plan
| Vulnerability | Severity | Fix | Timeline |
|---------------|----------|-----|----------|
| [Name] | [Level] | [Action] | [Date] |
## Security Test Coverage
- Input validation tests: [N] scenarios
- Authentication tests: [N] scenarios
- Authorization tests: [N] scenarios
- Encryption validation: [N] scenarios
## Sign-off
**Security Approved**: ✅ YES / ❌ NO / ⚠️ CONDITIONAL
**Conditions**:
[Any requirements for approval]
/**
* Test Suite: UserAuthentication
* Purpose: Validates user authentication workflows including login,
* logout, token refresh, and session management.
* Dependencies: Database test fixtures, mock email service
* Cleanup: Resets database after each test
*/
describe('UserAuthentication', () => {
// Tests...
});
1. Correctness
2. Security
3. Performance
4. Maintainability
5. Testability
Feedback Loop:
1. Validator identifies issues
2. Builder fixes issues
3. Validator re-validates
4. Repeat until quality gates met
Communication:
- Use PR comments for code-specific feedback
- Use validation report for overall assessment
- Be specific about what needs to change
Task: Create tests for user registration endpoint
## Test Plan
### Unit Tests (UserService)
1. Test valid user registration
2. Test duplicate email rejection
3. Test weak password rejection
4. Test email format validation
5. Test password hashing
### Integration Tests (API)
1. Test POST /register endpoint success
2. Test validation error responses
3. Test database transaction rollback
4. Test email notification trigger
### Security Tests
1. Test SQL injection attempts
2. Test XSS in username field
3. Test password strength requirements
4. Test rate limiting on registration
Result: 13 failing tests created, ready for builder implementation
Task: Validate authentication feature PR
## Validation Results
### Test Execution
- Total tests: 87
- Passing: 87
- Coverage: 94%
### Code Quality
- Linting: 0 errors
- Complexity: Acceptable
- Duplication: 2% (within limits)
### Security
- Vulnerabilities: 0 critical
- Password hashing: ✅ bcrypt with salt
- Token management: ✅ JWT with expiration
### Performance
- Login response: 45ms (target: <100ms) ✅
- Token validation: 2ms ✅
**Decision**: ✅ APPROVED - Ready to merge
Task: Validate refactoring PR for regressions
## Regression Analysis
### Tests Executed
- Full suite: 234 tests
- Previous failures: 0
- New failures: 2
### Regression Found
1. **Test**: User profile update
- Previous: PASS
- Current: FAIL
- Root Cause: Missing field in refactored model
- Action: Request fix
**Decision**: ❌ REJECTED - Regression detected, changes requested
resources/TEST_PLAN_template.md - Test plan templateresources/VALIDATION_REPORT_template.md - Validation report templateresources/security_checklist.md - Security review checklistscripts/run_tests.sh - Comprehensive test executionscripts/coverage_report.sh - Coverage analysisscripts/security_scan.sh - Security vulnerability scanningVersion: 1.0.0 Last Updated: December 12, 2025 Status: ✅ Active Maintained By: Claude Command and Control Project