Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO/IEC 25010 or ISO/IEC 29119-aligned QA recommendations.
8k tokens
context cost
the whole folder, loaded on every use
6
files
instructions only
0
copies elsewhere
how many repositories repackaged it
1201
stars on the repo
on the repository, not the skill itself
Install
one command, takes just this skill from the repository
Review and verify software quality with priority on security, performance, accessibility, correctness, test coverage, and standards-aligned quality evidence.
Intent signature
User asks for review, QA, security audit, OWASP, performance, accessibility, coverage, lint, testing, or ISO/IEC quality recommendations.
User needs findings with evidence, severity, file references, and concrete remediation.
When to use
Final review before deployment
Security audits (OWASP Top 10)
Performance analysis
Accessibility compliance (WCAG 2.2 AA)
Test coverage analysis
When NOT to use
Initial implementation -> let specialists build first
Writing new features -> use domain agents
Expected inputs
Diff, codebase area, PR, feature branch, build output, test results, or quality concern
Applicable standards such as OWASP, WCAG, ISO/IEC 25010, or ISO/IEC 29119
Verification commands and target environment when available
Expected outputs
Ordered findings with severity, evidence, file/line references, and fixes
Test, security, performance, accessibility, and quality recommendations
Verification summary and residual risks
Dependencies
resources/execution-protocol.md, ISO guide, and checklist
Automated tools such as npm audit, bandit, lighthouse, linters, tests, and coverage tools when applicable
Control-flow features
Branches by review type, available diff, quality dimension, and tool availability
Reads code and reports; may run tools; generally should not implement broad feature work
Findings must be reproducible and prioritized
Structural Flow
Entry
Identify review scope and quality dimensions.
Collect diff, files, commands, and standards context.
Choose automated checks before manual review where practical.
Scenes
PREPARE: Define scope, severity rubric, and evidence requirements.
ACQUIRE: Read diff/code and run relevant automated tools.
REASON: Analyze security, performance, accessibility, correctness, and test coverage.
VERIFY: Reproduce findings and reject false positives.
FINALIZE: Report findings, remediation, test gaps, and residual risk.
Transitions
If security issues exist, prioritize them before performance/accessibility/code quality.
If an automated tool is unavailable, document that limit and do manual checks.
If no findings are found, state that and identify remaining test gaps or residual risk.
If standards-based review is requested, use resources/iso-quality.md.
Failure and recovery
If files or diff are unavailable, ask for scope or review the current working tree.
If a finding cannot be reproduced, do not report it as a finding.
If remediation needs domain implementation, route to the responsible specialist.
Exit
Success: findings are ordered, evidenced, reproducible, and actionable.
Partial success: unavailable tools or unverified areas are explicit.
| Notify outcome | NOTIFY | Final review summary |
Tools and instruments
Security, lint, coverage, performance, accessibility, and test tools
ISO quality guide and checklist
Canonical command path
npm audit
bandit -r .
lighthouse <url>
Run only the tools that match the detected stack and available target. Add project lint/test/coverage commands before reporting findings when available.
Resource scope
| Scope | Resource target |
|-------|-----------------|
| CODEBASE | Reviewed source, tests, configs, and diff |
| PROCESS | Automated QA/security/performance/accessibility commands |