菜单
Comprehensive fullstack QA standard operating procedure — functional, security, visual, responsive, and data integrity testing. 5-layer pipeline with conditional checks, reusable patterns, and structured reporting. General-purpose — not framework-specific.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run 6-persona BMAD analysis for strategic product/business decisions, with agent cross-validation.
Initialize a new project with BMAD methodology — pull docs from Outline Cloud, setup _bmad structure, generate epics and stories, commit to develop branch. Reusable for any new product going through BMAD analysis.
Manual 3-persona adversarial security review for PRs — Blind Hunter, Edge Case Hunter, Acceptance Auditor. Use when Pi/ZAI are unreliable for analytical tasks.
EmbeddingGemma ONNX — CPU-only local embedding (onnxruntime+tokenizers, NO optimum/transformers). Model setup, embed function, Qdrant connection. Use embeddinggemma-knowledge or embeddinggemma-novel for specific use cases.
Full Discord server management via REST API — channels, roles, members, permissions. Bot has ADMINISTRATOR access.
Interact with Ghost CMS Admin API — publish posts, manage pages/tags/members, upload images, send newsletters.
| name | fullstack-qa-sop |
| description | Comprehensive fullstack QA standard operating procedure — functional, security, visual, responsive, and data integrity testing. 5-layer pipeline with conditional checks, reusable patterns, and structured reporting. General-purpose — not framework-specific. |
| version | 2.0.0 |
| license | MIT |
| tags | ["qa","fullstack","testing","security","visual","responsive","sop"] |
End-to-end QA standard operating procedure for fullstack web applications. Covers 5 test layers: functional, security, visual, responsive, and data integrity. Designed to be general-purpose — conditional checks skip gracefully when features don't apply.
Distilled from 150+ real tests across a production SaaS platform (85 functional + 67 security + 13 visual screenshots).
┌──────────────────────────────────────────────────────────────┐
│ Fullstack QA Pipeline │
├────────────┬────────────┬──────────┬──────────┬──────────────┤
│ Layer 1 │ Layer 2 │ Layer 3 │ Layer 4 │ Layer 5 │
│ Functional │ Security │ Visual │ Responsive│ Data │
│ E2E │ Audit │ Screens │ Viewports │ Integrity │
│ │ │ │ │ │
│ Playwright │ Python │ Playwright+│ Playwright │ psycopg2 │
│ + Node │ urllib │ Vision AI│ │ │
├────────────┴────────────┴──────────┴──────────┴──────────────┤
│ Conditional Skipping (graceful) │
│ Skip if feature not present in app │
└──────────────────────────────────────────────────────────────┘
Goal: Verify every page renders and every user flow works end-to-end using Playwright. Covers token injection patterns, test matrix by role, shadcn migration pitfalls, Svelte 5 auth race conditions, and false positive classification.
Goal: Systematic API security testing via Python urllib — no browser needed. Covers API helper, 9 security test categories, JWT attack tests, RBAC matrix discovery, and conditional skip logic. See also references/security-checklist.md for the full checklist.
Goal: Capture every page across roles for visual regression. Covers viewport configurations, dark/light mode toggle, screenshot quality checks (duplicate/blank detection), and Discord delivery.
Goal: Verify layout adapts correctly across breakpoints. Covers sidebar behavior, table overflow, touch targets, DOM-based responsive QA script, and column hiding rules.
Goal: Verify database state consistency after all tests. Covers before/after count verification, referential integrity, constraint validation, and migration count checks.
| Tool | Purpose |
|---|---|
| Playwright | Browser automation, screenshots |
| psycopg2 | DB queries, migration runner |
| Go SDK | Backend binary build (CGO_ENABLED=0) |
| boto3 | Object storage upload for screenshots |
| Vision AI API | Visual analysis of screenshots |
═══════════════════════════════════════════
FULLSTACK QA RESULTS
═══════════════════════════════════════════
Layer 1 — Functional: 80/85 passed (94%) [5 flaky]
Layer 2 — Security: 38/55 passed (69%) [12 skipped]
Layer 3 — Visual: 13 screenshots captured
Layer 4 — Responsive: 3 viewports tested
Layer 5 — Data Integrity: 10/10 checks passed
───────────────────────────────────────────
TOTAL: 131/150 passed (87%)
SKIPPED: 12 (conditional — not applicable)
FLAKY: 5 (pass individually)
═══════════════════════════════════════════
| Level | Criteria | Response Time |
|---|---|---|
| P0 — Critical | Data loss, auth bypass, brute-force possible, RCE | Immediate |
| P1 — High | SQL injection, CORS reflection, 500 on valid input, missing rate limit | Within 24h |
| P2 — Medium | Missing validation, inconsistent error codes, missing security headers | Within sprint |
| P3 — Low | Visual polish, UX inconsistencies, accessibility gaps | Next sprint |
Send in multiple messages (2000 char limit):
MEDIA: paths (max ~5 per message)Frequently encountered bugs across projects: CORS logic inversion, UUID→500 errors, rate limiter false negatives, double-unwrap API responses, SQL COALESCE type mismatches, missing DB columns in Go structs, and Svelte 5 auth race conditions.
Patterns that frequently trigger false alarms in static analysis: fmt.Sprintf in SQL, Docker template placeholders, centralized API clients, test file type errors, Vite IPv6 proxy issues, and JSON:API response shape differences.
playwright-local-qa — SvelteKit Playwright patterns, token injection, mock API, shadcn responsivego-api-e2e-testing — Go API security testing, migration runner, RBAC matrix discoverydogfood — Exploratory browser QA, issue taxonomy, evidence collectionsystematic-debugging — Root cause analysis for bugs found during QA