qa-expert

An agent skill by daymade, from daymade/claude-code-skills. Tags: analysis, qa, security, testing, validation.

What it does

This skill should be used when establishing comprehensive QA testing processes for any software project. Use when creating test strategies, writing test cases following Google Testing Standards, executing test plans, tracking bugs with P0-P4 classification, calculating quality metrics, or generating progress reports. Includes autonomous execution capability via master prompts and complete documentation templates for third-party QA team handoffs. Implements OWASP security testing and achieves 90% coverage targets.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill qa-expert

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/qa-expert ~/.claude/skills/qa-expert

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill sets up QA project scaffolding, writes tracking/report templates, and provides scripts plus large prompt bundles for autonomous test execution. The main risks are project-file overwrites, handling of secrets and shell/profile state from the onboarding examples, and overly autonomous writes to QA artifacts that can look like acceptance even when the underlying gate is only advisory.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It ships runnable Python scripts (`scripts/init_qa_project.py`, `scripts/calculate_metrics.py`) and instructs shell commands like `uv run ...`, but the execution is scoped to QA setup and reporting.
Network access	1 (low)	The docs use commands that can fetch packages or start services (`pnpm install`, `npx supabase start`), but they do not themselves send data to external hosts beyond normal dependency retrieval.
Filesystem reach	2 (moderate)	The initializer writes multiple files under `tests/docs/` and explicitly warns that a fresh root is needed because templates are overwritten; the onboarding docs also include a recursive delete example in the home dotdir.
Secrets & credentials	2 (moderate)	The onboarding flow tells the user to copy/edit `.env`, uses example passwords, and includes clearing browser cookies/local storage, so it can touch credentials and session data.
Privilege & persistence	2 (moderate)	It suggests global installation and shell-environment changes (`pnpm link --global`, adding PATH entries, editing `~/.bashrc` / `~/.zshrc`), which can alter user-level system behavior.
Instruction hijack surface	1 (low)	The skill is built around copying bundled prompt text into an agent session (`references/master_qa_prompt.md`, `references/llm_prompts_library.md`), so it strongly steers agent behavior even though it does not ask to ignore safety rules.
Irreversible actions	2 (moderate)	It explicitly enables autonomous QA execution, auto-updates tracking CSVs, auto-files bugs, and can stop the run on P0 findings, which broadens the blast radius of an agent run.
Transparency	1 (low)	The bundled metrics CLI is transparent code, but the skill notes it can print failing checks while still exiting 0, so command success does not prove release acceptance.

Before installing

Read `scripts/init_qa_project.py` first; only run it in a scratch project root because it overwrites generated templates.
Do not let the agent execute the example `rm -rf ~/.claude/skills/<skill-name>` or shell-profile edits unless you explicitly want those home-directory changes.
Run the metrics script once on sample CSVs and confirm you understand that its exit code is not a release decision.
If you will use autonomous QA mode, verify the project’s approved test plan and escalation policy before pasting the master prompt.

Rated 2026-10-17 by an automated review of 11 files from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: qa-expert/SKILL.md
Branch: main
Updated: 2026-09-20

post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
principle-prove-it-works — Apply after completing a task, before declaring done.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
blast-radius — Find what a change could break somewhere else before it ships, beyond the diff.
constant-time-testing — Measures timing side channels in cryptographic implementations by running them.
fp-check — Systematically verifies suspected security bugs to eliminate false positives.