Security scanning across SAST, DAST, SCA, secrets and SBOM: Semgrep, CodeQL, SonarQube, ZAP, Nuclei, Snyk, OSV-Scanner, gitleaks, Syft and Trivy. Also covers language-native SAST linters, Dependabot and Renovate, package-manager audits, reachability and CVE exploitability triage, secret rotation, and VEX. A gate agent (security-finding-triager) normalizes, dedupes and waiver-checks multi-scanner output, including IaC findings from qa-iac, into one BLOCK / PASS verdict per domain. Every scanner skill includes a false-positive triage section.
17 skills · 1 agent
Test process and strategy: risk-based testing, test strategies, Definition of Done, smoke gates, test pyramid balance, effort estimates and post-mortems. Also covers E2E suite budgets, test ideas from stories and live features, framework choice, and attack-surface checklists. Agents (release-readiness-checker, quality-coach, release-engineer) run multi-gate go / no-go checks, audit work against the Definition of Done, and walk a release runbook with human gates.
12 skills · 3 agents
Test data engineering: Faker and factories, WireMock and MSW API mocks, seed datasets, golden files, and boundary, pairwise and negative test inputs. Includes FactoryBot, Mimesis and Bogus, a Mountebank reference, synthetic PII, and a malicious payload bank. Agents (golden-file-manager, test-data-setup-agent) maintain snapshot baselines and set up a feature's full test-data layer.
12 skills · 2 agents
Test reporting and coverage analytics: JUnit XML, LCOV and Cobertura parsing, Allure reports, coverage diffs, and test run summaries for pull requests. Also covers JaCoCo and coverage.py analysis, risk-ranked coverage targets, TestRail / Xray / Zephyr Scale result sync, and Currents analytics. Agents (daily-test-suite-aggregator, release-quality-report-agent) roll up daily results across suites and assemble a release-quality go / no-go report. Jest and Vitest coverage lives in qa-unit-tests-js.
10 skills · 2 agents
Test code review for test files only: conventions, isolation, object-model patterns, framework architecture audits, and test suite health checks. Includes a framework blueprint for new suites and a test design scorecard. Agents (test-code-critic, e2e-selector-quality-critic, framework-architecture-auditor, test-suite-health-auditor) review structure, assertions and mocking, selector fragility, framework architecture, and suite health. Production code is out of scope.
7 skills · 4 agents
Background job and queue testing for Sidekiq, Celery, BullMQ, SQS, RabbitMQ and Kafka consumers, plus cron schedules and idempotency guarantees. A read-only critic agent (async-job-health-critic) flags missing retry limits, absent dead-letter routing, and other at-least-once reliability defects in queue and worker code.
8 skills · 1 agent