菜单
[QA Process · ISO 31000 + ISTQB CTFL v4.0] Risk-based test prioritization — builds a risk matrix (likelihood × impact), ranks test areas by priority, and flags critical paths for performance testing.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/aibot88/sec_skill_store --skill qa-risk命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
Guía técnica completa para integrar 250+ servicios externos con agentes IA usando Composio. Cubre instalación, autenticación OAuth, gestión de herramientas, triggers y flujos multi-servicio.
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
基于 SOC 职业分类
正在显示 SKILL.md
| name | qa-risk |
| description | [QA Process · ISO 31000 + ISTQB CTFL v4.0] Risk-based test prioritization — builds a risk matrix (likelihood × impact), ranks test areas by priority, and flags critical paths for performance testing. |
📚 Knowledge References (loaded automatically):
qa-risk-patterns.md— ISO 31000 risk framework, ISTQB risk-based testing, likelihood/impact matrices
Risk-based testing ensures the highest-risk areas get the most test coverage. Fail fast on what matters most.
Scan the codebase and ask:
1. What are the most business-critical features?
2. What changed most in this release?
3. What broke in previous releases?
4. What has the lowest test coverage now?
5. Any third-party integrations or external dependencies?
Score each area: Likelihood (1–4) × Impact (1–4) = Risk Score
| Feature / Area | Likelihood | Impact | Score | Priority |
|-----------------------|------------|--------|-------|----------|
| Payment processing | 2 | 4 | 8 | 🔴 High |
| User authentication | 2 | 4 | 8 | 🔴 High |
| Search / filtering | 3 | 2 | 6 | 🟡 Med |
| Admin dashboard | 1 | 3 | 3 | 🟢 Low |
Priority mapping:
For each High-priority area, assign mandatory test coverage:
| Area | Unit | Integration | E2E | Security | Load Test |
|--------------------|------|-------------|-----|----------|-----------|
| Payment processing | ✅ | ✅ | ✅ | ✅ | ✅ flag |
| Authentication | ✅ | ✅ | ✅ | ✅ | — |
Flag for Tier 3 Performance: Areas with Score ≥ 8 AND high concurrent usage → add to /helix test-perf-load scope.
Save to docs/qa/qa-risk-YYYY-MM-DD.md:
Present risk matrix + flag list.
If any Tier 3 flags exist, remind user: run /helix test-perf-load separately with flagged endpoints.
Suggest next step: proceed with test execution tiers or /helix qa-explore
1. Risk matrix ครอบคลุม business-critical features ไหม?
2. Score calculation สม่ำเสมอไหม?
3. Tier 3 flags สมเหตุสมผลไหม?
4. มี area ที่ลืมไปไหม?