Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
17 skills · 1 agent
Test process and strategy: risk-based testing, test strategies, Definition of Done, smoke gates, test pyramid balance, effort estimates and post-mortems. Also covers E2E suite budgets, test ideas from stories and live features, framework choice, and attack-surface checklists. Agents (release-readiness-checker, quality-coach, release-engineer) run multi-gate go / no-go checks, audit work against the Definition of Done, and walk a release runbook with human gates.
12 skills · 3 agents
Test data engineering: Faker and factories, WireMock and MSW API mocks, seed datasets, golden files, and boundary, pairwise and negative test inputs. Includes FactoryBot, Mimesis and Bogus, a Mountebank reference, synthetic PII, and a malicious payload bank. Agents (golden-file-manager, test-data-setup-agent) maintain snapshot baselines and set up a feature's full test-data layer.
12 skills · 2 agents
Test code review for test files only: conventions, isolation, object-model patterns, framework architecture audits, and test suite health checks. Includes a framework blueprint for new suites and a test design scorecard. Agents (test-code-critic, e2e-selector-quality-critic, framework-architecture-auditor, test-suite-health-auditor) review structure, assertions and mocking, selector fragility, framework architecture, and suite health. Production code is out of scope.
7 skills · 4 agents
Web E2E testing with Playwright, Cypress, Selenium and WebdriverIO, plus cloud grids, a self-hosted Selenium Grid 4, and cross-browser test matrices. Covers BrowserStack, Sauce Labs and LambdaTest, traffic-based T1/T2/T3 browser tiers, a framework decision guide, and Playwright's agent tooling (playwright-cli, Playwright MCP, planner/generator/healer Test Agents). Agents (playwright-codegen-reviewer, automation-harness-bootstrapper) refactor recorded Playwright or Cypress Studio specs and scaffold a full E2E harness for a repo with no suite.
9 skills · 2 agents
Background job and queue testing for Sidekiq, Celery, BullMQ, SQS, RabbitMQ and Kafka consumers, plus cron schedules and idempotency guarantees. A read-only critic agent (async-job-health-critic) flags missing retry limits, absent dead-letter routing, and other at-least-once reliability defects in queue and worker code.
8 skills · 1 agent