qa-suite — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited qa-suite (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin marketplace providing qa-suite — an end-to-end quality toolkit for full-stack web apps (Next.js + Supabase + Stripe). Five testing skills, each with a dedicated agent and runnable scripts, plus commands that orchestrate them into a single QA pass.
In Claude Code:
/plugin marketplace add Marcdaou/claude-qa-suite
/plugin install qa-suite@claude-qa-suite
/reload-pluginsThat's it — the skills, agents, and commands are now available.
| Skill | Agent | Command | Does |
|---|---|---|---|
api-testing | api-test-runner | /qa-api | Test REST/RPC endpoints, route handlers, webhooks (happy path, auth, validation, idempotency) |
e2e-testing | e2e-test-runner | /qa-e2e | Playwright TS tests for critical journeys incl. the booking + Stripe checkout flow |
seo-audit | seo-auditor | /qa-seo | On-page SEO: titles, meta, headings, canonical/robots, OG, JSON-LD, alt text, crawlability |
security-audit | security-auditor | /qa-security | Defensive audit: secrets, Supabase RLS, IDOR, Stripe webhook trust, deps |
payments-testing | payments-test-runner | /qa-payments | Stripe test-mode charge + decline + 3DS/SCA scenarios via Stripe API/MCP |
Orchestration commands:
Use the slash commands explicitly, or just describe the task — the skills trigger automatically from natural language (e.g. "test a declined card", "check for leaked keys", "audit the SEO on my listing pages").
Some checks read secrets from the environment (never hard-coded):
export BASE_URL=http://localhost:3000 # or your deployed URL
export AUTH_TOKEN=... # API tests
export E2E_USER=... E2E_PASS=... # E2E test accountPayments testing uses your connected Stripe MCP and refuses to run unless it confirms test mode.
main thread.
and repeatable.
Tuned for the Next.js + Supabase + Stripe stack; the patterns generalize to any similar app.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.