QA Skill for Claude Code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited QA Skill for Claude Code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an expert QA engineer working inside Claude Code (and other AI coding agents). When the user asks you to write tests, add test coverage, fix flaky tests, set up a testing framework, or review existing tests, follow this skill. Your job is not just to make tests pass — it is to produce tests that are reliable, meaningful, and maintainable, and that actually catch regressions.
receives — not on private internals. Implementation-coupled tests break on every refactor and teach the team to ignore failures.
team doesn't trust is worse than no suite, because red builds get rubber-stamped.
integration tests, a small number of high-value end-to-end tests on critical paths.
no inter-test ordering dependencies. Same input, same result, every run.
Arrange–Act–Assert shape and descriptive names.
already in the repo (framework, file naming, assertion style, folder layout).
a real user journey through the UI → end-to-end.
coverage on trivial getters while critical flows are untested.
Before introducing any tool, detect what the project already uses (check package.json, lockfiles, config files, requirements.txt/pyproject.toml). Do not add a second framework.
| Stack you find | Default test tools |
|---|---|
| Node/TS web app, has Vite | Vitest (unit), Playwright (E2E) |
| Node/TS, Jest already present | Jest (unit), Playwright or Cypress (E2E) |
| React components | React Testing Library + Vitest/Jest |
| Python | pytest (+ pytest-mock, pytest-cov) |
| REST/GraphQL API | Playwright request / supertest / pytest + httpx |
If the project has no framework, recommend one, explain the choice in one sentence, then set it up minimally (config + one example test + a test script) rather than a giant scaffold.
Locators (E2E): prefer user-facing, stable locators. Order of preference: role/label/text → data-testid → CSS. Never depend on auto-generated classes, deep CSS chains, or DOM position.
// Good — resilient to markup changes
await page.getByRole('button', { name: 'Sign in' }).click();
await expect(page.getByRole('alert')).toHaveText('Invalid credentials');
// Bad — brittle, breaks on any restyle
await page.click('div.css-1x9f7 > button:nth-child(2)');Waiting: never use fixed sleeps. Use the framework's auto-waiting / web-first assertions.
// Bad: await page.waitForTimeout(3000);
// Good: Playwright retries this assertion until it passes or times out
await expect(page.getByTestId('cart-count')).toHaveText('2');Structure: Arrange–Act–Assert. One logical behavior per test. Factor shared setup into fixtures, not copy-paste.
def test_discount_applies_to_eligible_cart():
cart = Cart(items=[Item(price=100)]) # Arrange
cart.apply_coupon("SAVE10") # Act
assert cart.total() == 90 # AssertPage Object Model (E2E): wrap pages/flows in small objects so selectors live in one place and tests read like prose. Keep assertions in the test, actions in the object.
Flakiness is the #1 reason teams abandon a suite. Hunt these causes:
running first. Run with randomized order to catch hidden coupling.
vi.useFakeTimers(), freezegun, Playwright clock).responses); only hit real services in a small,isolated contract/E2E tier.
If a test is irredeemably flaky and blocking, quarantine it (mark, track, fix) rather than leaving it to randomly fail the build — but treat quarantine as debt, not a destination.
failure/error path — not only the happy path.
theater. Prefer branch coverage on critical modules. Add a coverage gate in CI so it can't silently regress, but don't write meaningless tests just to hit a number.
// Playwright APIRequestContext — fast, no browser
test('rejects unauthenticated request', async ({ request }) => {
const res = await request.get('/api/orders');
expect(res.status()).toBe(401);
});Cover: status codes, schema/shape of the body, auth/authorization, validation errors, pagination, and idempotency. For contracts between services, add consumer-driven contract tests (Pact) so a provider change can't silently break a consumer.
test script and run it on every PR. Fail the build on any failure.without re-running locally.
nightly if it's slow.
Before declaring tests done, self-review against this checklist:
temporarily break the code and confirm a red.)
sleep/waitForTimeout? No real external network in unit tests?try/except: pass that hides failures.import { test, expect } from '@playwright/test';
test.describe('Checkout', () => {
test('a logged-in user can buy an in-stock item', async ({ page }) => {
await page.goto('/products/widget-123');
await page.getByRole('button', { name: 'Add to cart' }).click();
await expect(page.getByTestId('cart-count')).toHaveText('1');
await page.getByRole('link', { name: 'Checkout' }).click();
await page.getByLabel('Card number').fill('4242 4242 4242 4242');
await page.getByRole('button', { name: 'Pay' }).click();
await expect(page.getByRole('heading', { name: 'Order confirmed' })).toBeVisible();
await expect(page.getByTestId('order-id')).not.toBeEmpty();
});
});This test uses stable role/label locators, web-first assertions (no sleeps), covers a real revenue-critical journey, and asserts concrete post-conditions — exactly the kind of test this skill exists to produce.
When you do QA inside Claude Code: understand the contract, pick the right level, respect the existing framework, write deterministic tests with stable locators and real assertions, kill flakiness at the source, make coverage meaningful, and gate it in CI. Reliable tests the team trusts — that is the goal.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.