qa-skill-suite

Root skill for Software Testing / QA engineers — aligned with ISTQB Foundation, Advanced (Test Analyst, Technical Test Analyst, Test Manager), and Agile Extension syllabi. Load when asked to help with any testing task: manual testing, exploratory testing, test design, writing automated tests, security testing, performance testing, reviewing test quality, planning test strategy, filing bug reports, or analyzing coverage. Delegates to sub-skills: qa/manual-test, qa/unit-test, qa/api-test, qa/e2e-test, qa/performance-test, qa/security-test, qa/test-review, qa/bug-report, qa/test-plan. Trigger phrases: "test", "QA", "quality", "coverage", "defect", "bug", "regression", "smoke test", "test plan", "test strategy", "exploratory", "ISTQB", "SDET", "automation".

Design and build test automation frameworks from scratch. Load when asked about automation architecture, framework design, test pyramid strategy, choosing between POM vs Screenplay pattern, data-driven or keyword-driven frameworks, setting up CI/CD pipelines for test automation, parallel execution, folder structure, or how to scale a test suite. Aligned with ISTQB CTAL-TAE v2.0 and CT-TAS v1.0. Trigger phrases: "automation framework", "framework architecture", "test pyramid", "how to structure tests", "CI pipeline for testing", "parallel testing", "POM vs Screenplay", "data-driven framework", "keyword-driven", "hybrid framework", "scale automation", "automation strategy", "framework from scratch", "test infrastructure".

Test REST and GraphQL APIs, database queries, and service contracts. Load when asked to test HTTP endpoints, validate response schemas, do contract testing, test authentication flows, test database interactions, or verify API error handling. Supports pytest+httpx, Jest+Supertest, RestAssured, Postman/Newman, Pact, and database testing (SQL, MongoDB). Includes field-level assertions, IDOR testing, rate limit testing, and mobile API patterns. Trigger phrases: "test the API", "API test", "HTTP test", "endpoint test", "contract test", "test the endpoint", "REST test", "GraphQL test", "Postman", "schema validation", "database test", "DB test", "RestAssured", "test service", "integration test API".

Write end-to-end browser tests and UI automation scripts. Load when asked to automate user flows, test UI interactions, write browser tests, or verify full-stack journeys. Supports Playwright (primary), Cypress, and Selenium WebDriver. Generates Page Object Model (POM) code, test fixtures, and CI configuration. Trigger phrases: "e2e test", "browser test", "automate user flow", "Playwright", "Cypress", "Selenium", "UI test", "end-to-end", "test the login flow", "automate this journey", "smoke test", "regression test".

Write performance, load, and stress tests for APIs and services. Load when asked to load test, stress test, benchmark, or performance test a service. Generates k6 scripts (primary), JMeter test plans, and Locust scripts. Provides patterns for spike testing, soak testing, breakpoint testing, and interpreting results. Trigger phrases: "load test", "performance test", "stress test", "benchmark", "k6", "JMeter", "Locust", "throughput", "latency", "RPS", "concurrent users", "response time", "SLA", "p95", "p99".

Plan and execute security testing for web applications and APIs. Load when asked to security test, find vulnerabilities, do penetration testing, test OWASP Top 10, check for injection, XSS, IDOR, broken authentication, or review code for security issues. Covers OWASP WSTG, OWASP Top 10, OWASP LLM Top 10, SAST/DAST tooling, and generates security test cases, vulnerability reports, and security checklists. Trigger phrases: "security test", "penetration test", "pentest", "OWASP", "SQL injection", "XSS", "vulnerability", "IDOR", "broken auth", "security review", "SAST", "DAST", "security scan", "threat model", "LLM security", "AI security".

Write unit tests and integration tests for any language or framework. Load when asked to write tests for a function, class, module, or service. Supports pytest, Jest, Vitest, JUnit 5, xUnit, RSpec, Go testing, Mocha, TestNG, and more. Generates test code with AAA pattern, mocking strategies, parameterized tests, snapshot tests, BDD-style tests, and coverage gap analysis. Includes anti-pattern detection and verification-before- completion gate. Trigger phrases: "write unit tests", "test this function", "add tests", "mock this dependency", "TDD", "integration test", "snapshot test", "test coverage", "component test", "SDET", "pytest", "Jest", "JUnit".

Create structured, reproducible bug reports for software defects. Load when asked to file a bug, report an issue, write a defect report, or document unexpected behavior. Generates complete bug reports with steps to reproduce, expected vs actual behavior, severity classification, environment details, and evidence. Also provides templates for Jira, GitHub Issues, and Linear. Trigger phrases: "report this bug", "file a bug", "write a bug report", "this is broken", "defect report", "issue template", "bug template", "document this issue", "create a ticket".

Plan and execute manual testing, exploratory testing, and session-based testing. Load when asked to write manual test cases, plan exploratory sessions, do regression testing checklists, acceptance testing (UAT), create test scripts, or design test cases using ISTQB techniques (equivalence partitioning, boundary value analysis, decision tables, state transition, pairwise). Outputs TC-ID formatted test cases with steps and expected results. Trigger phrases: "manual test", "test case", "exploratory testing", "UAT", "regression checklist", "acceptance test", "test script", "equivalence partitioning", "boundary value", "decision table", "state transition", "exploratory session", "SBET".

Create ISTQB-aligned test plans, test strategies, risk analyses, test metrics, and QA documentation. Load when asked to write a test plan, test strategy, define testing scope, analyze coverage gaps, create test cases for a feature, define metrics, build a QA roadmap, or document the QA approach for a sprint, release, or project. Aligns with ISTQB Foundation, Advanced Test Manager, and ISO 29119. Generates test plans, risk matrices, coverage maps, metrics dashboards, and Definition of Done checklists. Trigger phrases: "test plan", "test strategy", "test scope", "QA plan", "coverage analysis", "test metrics", "quality metrics", "release checklist", "test manager", "ISTQB test plan", "test policy", "test estimation", "risk-based testing", "QA roadmap", "master test plan".

Review test suites for quality issues, anti-patterns, and coverage gaps. Load when asked to review tests, audit test quality, find bad tests, detect anti-patterns, check if tests are trustworthy, verify test coverage is real (not fake), or analyze whether a test suite actually protects the codebase. Identifies: false positives, brittle tests, missing assertions, non-independent tests, tautological tests, and coverage theater. Also acts as "verification-before-completion" gate — forces validation of test completeness before declaring a feature done. Trigger phrases: "review my tests", "are these tests good?", "test quality", "anti-pattern", "brittle test", "flaky test", "coverage is fake", "verify done", "test audit", "check my test suite", "is this test correct?", "test smell".