qa — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited qa (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run an interactive QA session. The user describes problems they're encountering. You clarify, explore the codebase for context, and file GitHub issues that are durable, user-focused, and use the project's domain language. For any one bug that needs deeper diagnosis before it can be filed lightweight, you delegate to /triage-issue for that issue and then return to the loop for the next observation.
This is a side-route skill, not a default shaping or implementation step. It is the single entry point for bug conversations — /triage-issue is no longer a direct entry point and is instead invoked from here on a per-issue basis when depth is needed.
Use /qa when the user is testing behavior, reporting bugs conversationally, or wants help turning observed failures into durable GitHub issues.
Do not use it when the task is already a concrete, well-scoped implementation task ready for /execute.
One question per turn. When clarifying a reported bug, ask one question at a time and wait for the answer before asking the next. Do not over-interview — two or three short questions is usually enough, but they are asked sequentially, never as a batched list.
>
Prefer single-select. Use single-select multiple choice when the user is choosing one direction, one priority, or one next step.
>
Use multi-select rarely. Reserve it for compatible sets — goals, constraints, non-goals, success criteria — that can all coexist. If prioritization matters, follow up asking which selected item is primary.
>
Use the platform's question tool when available. In Claude Code, useAskUserQuestion; in Codex,request_user_input; in Gemini,ask_user. Otherwise, present numbered options in chat and wait for the user's reply before proceeding.
Let the user describe the problem in their own words. Ask up to 2–3 short clarifying questions one at a time, focused on:
Do NOT over-interview. If the description is clear enough to file, move on.
Destination check (always ask last). After symptom / reproducer / expected-vs-actual, ask one more question — the destination check from references/destination-check.md:
How will we know the fix worked end-to-end? Name the specific destination — a file/function, a log query, a dashboard view, a user-observable behavior, an assertion in a test — where the fix's effect must land.
Record the answer as a Verification destination: line in the filed issue body (Step 4b template). Then consult references/destination-check.md's signal table against the user's framing of the bug and the proposed fix. Count signals:
/research Phase 0 before filing. Phase 0 will grep the repo for the corresponding consumer/setup code; if it returns null, reshape the issue from "set the flag" to "wire the missing consumer" before any code is written. The user retains agency to file lightweight anyway, but the nudge surfaces the reachability constraint instead of leaving it in the developer's head.This catches source-vs-destination mismatch at intake — a fix that flips a producer-side value without verifying that any consumer reads it, a cache invalidation with no subscriber, a permission grant with no enforcer, a telemetry flag with no emission boundary registered in the target runtime. See references/destination-check.md for substantive vs vacuous examples and the full signal table.
While talking to the user, kick off an Agent (subagent_type=Explore) in the background to understand the relevant area. The goal is NOT to find a fix — it's to:
This context helps you write a better issue — but the issue itself should NOT reference specific files, line numbers, or internal implementation details.
Before filing, decide whether this is a single issue or needs to be broken down into multiple issues.
Break down when:
Keep as a single issue when:
For each issue identified in Step 3, decide whether it can be filed lightweight or needs deeper diagnosis. Apply this decision per issue, not per session — most QA sessions mix both kinds.
Delegate to `/triage-issue` when at least one of these holds:
Stay lightweight (continue to Step 4) when:
When delegating to `/triage-issue`:
/triage-issue will require building a deterministic, agent-runnable feedback loop that reproduces the failure before any hypothesis work, then ranking 3-5 falsifiable hypotheses against that loop. Expect a longer cycle than a lightweight file — the discipline pays off on hard bugs by replacing guesswork with a measurable signal.
/triage-issue Steps 2–5 (reproduce, explore + diagnose, optional structural diagnosis, fix approach, TDD fix plan, issue creation) on this single bug./triage-issue replaces the lightweight issue Step 4 would otherwise have filed for this bug — do not file both./qa loop and continue with the next observation in Step 5.If Step 3 produced a breakdown, apply this depth decision to each sub-issue independently. A single QA report can produce a mix of lightweight /qa issues and deep /triage-issue issues.
This step runs only for issues that stayed lightweight in Step 3.5. Issues that delegated to /triage-issue are already filed by that skill and skip this step.
#### 4a. Closed-wontfix lookback (before filing)
Before creating each issue, search closed wontfix issues for the same idea. Already-rejected enhancements resurfacing as fresh issues consume triage cycles every time:
gh issue list --state closed --label wontfix --search "<keywords from this report>"Pick keywords from the user's own description and the domain language you learned in Step 2 — not internal module names. Run the search before each issue, not once per session.
If a prior rejection surfaces:
This is a process check, not an enforcement gate — closed-wontfix history is treated as durable state that lives in GitHub. Skill Kit deliberately does not maintain a parallel filesystem archive of rejected enhancements (per SYSTEM-OVERVIEW.md "State lives in GitHub, not the filesystem").
#### 4b. Create the issue
Create issues with gh issue create. Do NOT ask the user to review first — just file and share URLs.
Issues must be durable — they should still make sense after major refactors. Write from the user's perspective.
#### For a single issue
Use this template:
## What happened
[Describe the actual behavior the user experienced, in plain language]
## What I expected
[Describe the expected behavior]
## Steps to reproduce
1. [Concrete, numbered steps a developer can follow]
2. [Use domain terms from the codebase, not internal module names]
3. [Include relevant inputs, flags, or configuration]
## Verification destination
[The destination the fix's effect must reach, named in domain terms — a user-observable behavior, a log/trace observation, a dashboard view, an assertion in a test. Must be distinct from the proposed source-of-change. See `references/destination-check.md` for the substantive vs vacuous bar.]
## Additional context
[A short plain-language walkthrough that frames the bug for a reader unfamiliar with the codebase: one paragraph of domain setup (what part of the system this touches, in the user's own words), the bug stated in plain English, and why it matters to a user or future maintainer. Skip the walkthrough for trivially-reproducible bugs with no domain nuance — a single line is fine there. Use domain language but don't cite files or line numbers. See `references/writing-for-humans.md` for the shape and revision bar.]#### For a breakdown (multiple issues)
Create issues in dependency order (blockers first) so you can reference real issue numbers.
Use this template for each sub-issue:
## Parent issue
#<parent-issue-number> (if you created a tracking issue) or "Reported during QA session"
## What's wrong
[Describe this specific behavior problem — just this slice, not the whole report]
## What I expected
[Expected behavior for this specific slice]
## Steps to reproduce
1. [Steps specific to THIS issue]
## Verification destination
[The destination this slice's fix must reach — domain-language, distinct from the source-of-change. See `references/destination-check.md`.]
## Blocked by
- #<issue-number> (if this issue can't be fixed until another is resolved)
Or "None — can start immediately" if no blockers.
## Additional context
[Any extra observations relevant to this slice]When creating a breakdown:
#### Rules for all issue bodies
After filing, print all issue URLs (with blocking relationships summarized) and ask: "Next issue, or are we done?"
Keep going until the user says they're done. Each issue is independent — don't batch them.
/qa is the single entry point for bug conversations/triage-issue when depth was needed/triage-issue for bugs that fail the Step 3.5 depth check; control returns to the /qa loop after each delegation/execute once the filed bug work is ready to implement~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.