v3.0.0 — 50 QA Skills, TDD-validated

50 skills, TDD-validated, with an executable eval runner

v3.0.0 grows the library from 43 to 50 skills, re-templates every existing skill to one house format, and turns the evals from inert data into something a runner actually checks.

➕ 7 new skills (43 → 50)

Found via a multi-lens gap analysis + judge panel, then built through a research → author → review pipeline (the review stage caught a fabricated Jest fake-timers claim, a 16-digit secret-scan that would have flagged every legitimate test card, and several missing sections before they shipped):

Skill	Category	What it does
test-case-management	Process	Manual/hybrid cases in TestRail/Xray/Zephyr/Qase — anatomy, bulk authoring from stories, ambiguous-step linting, CSV/API import-export, traceability
test-suite-curation	Process	Evidence-based regression-suite pruning — coverage fingerprinting, AST duplicate clustering, CI-history mining, smoke/core/extended tiering, quarantine-before-delete
bug-reproduction	AI-QA	Vague report → verified minimal repro → failing regression test; git bisect, deterministic repro, red-before-fix
agentic-browser-testing	AI-QA	Goal-driven E2E via a browser agent (Playwright MCP / computer-use) — determinism controls, cost budgets, accessibility-tree interaction, graduation to scripted tests
email-testing	Specialized	Signup/reset/magic-link/OTP flows via Mailpit/Mailosaur/MailSlurp — inbox polling, link/OTP extraction, deliverability checks
payment-testing	Specialized	Stripe (+ Adyen/Braintree/PayPal) sandboxes — test cards, 3DS/SCA iframes, test clocks, webhook signature/idempotency, refunds
analytics-tracking-testing	Specialized	GA4/dataLayer/pixel correctness — tracking-plan contract, beacon interception, param/value/timing assertions, Consent Mode v2, CI gating

🛡️ AI-agent / LLM security coverage

Prompted by a real indirect-prompt-injection payload disguised as a security finding:

• security-testing gains an OWASP LLM Top 10 (2025) section and routes LLM-layer attacks to ai-system-testing.
• ai-system-testing gains indirect-injection (tool output / RAG / scan reports), self-propagating directives, exfil-via-agent, and a defend-the-tester section.
• Ships skills/ai-system-testing/scripts/detect_injection.py — a self-tested scanner (10 attack-marker rule classes) plus references/injection-detector.md.

🔁 All 43 existing skills re-templated

Every SKILL.md brought to one house format (docs/SKILL_TEMPLATE.md): <objective>, Discovery Questions, Core Principles, domain sections, Anti-Patterns, Verification, objectively-checkable Done When, Related Skills. Heavy code pushed into references/. Currency pass on every named tool/version.

✅ Evals are now executable

• scripts/run_evals.py — --static (content proxy, CI-safe), --baseline (RED), --live (GREEN, via claude -p).
• Extended scripts/validate_skills.py and a generated scripts/build_index.py (skills_index.json had drifted to v2.5.0).
• A CI workflow runs the validator + static evals + index check + injection-detector selftest on every PR.
• Library health: validator 0 errors across 50 skills; static evals 92% checkable pass.

📚 Docs & site

README.md, CLAUDE.md, AGENTS.md, and the landing page updated to 50 skills with new disambiguation rules. docs/SKILL_TEMPLATE.md is the new authoring contract.

Install: npx skills add petrkindlmann/qa-skills

v2.1.0 — 40 skills + QA Report Humanizer

New skill: qa-report-humanizer

Skill #40. Detects and rewrites AI patterns in QA reports, bug reports, test summaries, status updates, and stakeholder communications.

10 QA-specific anti-patterns with bad/better examples:

• Template openers that bury the signal
• Inflated severity language
• Pass rate obsession without context
• Generic risk language ("several high-risk areas require monitoring")
• PR review comments that say nothing
• Bug reports that start with the testing session instead of the bug

Format-specific guidance for test summaries, bug reports, sprint updates, Slack messages, and postmortems.

Other changes

• Humanized README and CONTRIBUTING copy (removed AI writing patterns)
• Landing page redesigned with split hero layout, terminal demo, hover effects, staggered animations
• Creator and project ecosystem visible earlier on landing page
• All references updated from 39 to 40 skills

v2.0.0 — 39 QA Skills for AI Agents

QA Skills for AI Agents — Complete Collection

39 production-grade skills covering the full QA lifecycle, built for Claude Code, Codex, Cursor, Gemini CLI, and any Agent Skills Standard-compatible tool.

Install

npx skills add petrkindlmann/qa-skills

Categories (39 skills)

• Foundation (1): qa-project-context
• Strategy (4): test-strategy, test-planning, risk-based-testing, exploratory-testing
• Automation (7): playwright-automation, cypress-automation, api-testing, unit-testing, mobile-testing, visual-testing, performance-testing
• Specialized (4): accessibility-testing, security-testing, cross-browser-testing, database-testing
• AI-Augmented QA (4): ai-test-generation, ai-bug-triage, test-reliability, ai-qa-review
• Infrastructure (5): ci-cd-integration, test-environments, test-data-management, contract-testing, service-virtualization
• Metrics (3): qa-metrics, qa-dashboard, coverage-analysis
• Process (5): shift-left-testing, qa-project-bootstrap, release-readiness, quality-postmortem, compliance-testing
• Production & Observability (3): testing-in-production, synthetic-monitoring, observability-driven-testing
• Knowledge & Migration (3): ai-system-testing, chaos-engineering, test-migration

Highlights

• Playwright-first with 8 deep reference files
• 4 AI-augmented QA skills nobody else has
• Staged pipeline for AI test generation with guardrails
• Hybrid fingerprint + LLM bug triage
• 14 reference files for production-depth content
• GitHub Actions validation workflow
• Compatible with 6+ AI coding agents

Built from real QA automation work across 6+ production websites.

⭐ Star to follow new skills and updates