qa-audit
Skill4 starsChanged 12 days agoMITView on GitHub
Use when performing a quality audit, security review, or robustness check. Covers XSS/innerHTML scanning, rule compliance verification, race condition analysis, config schema validation, and documentation drift detection. Produces a severity-classified report (Critical/High/Medium/Low).
3 other projects use a version of this.
Adopted by
Most recently taken up by
- Myriambs/argus-qatheir own version, first seen Nov 1, 2026
- ask-marcel/ask-marcel-office-clitheir own version, first seen Oct 25, 2026
- ngreenwall/claude-skillstheir own version, first seen Jul 9, 2026
Other versions3 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 3
- ask-marcel/ask-marcel-office-cli★ 9same name
- ngreenwall/claude-skills★ 2same name
- Myriambs/argus-qa★ 0same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository34 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- architecture-changeSkill
- brainstormingSkill
- doc-auditSkill
- feature-deliverySkill
- find-skillsSkill
- frontend-designSkill
- hotfixSkill
- jules-tasksSkill
- qa-auditSkill
- release-readinessSkill
- requesting-code-reviewSkill
- setup-repoSkill
- skill-creatorSkill
- systematic-debuggingSkill
- using-superpowersSkill
- writing-plansSkill
- architecture-changeSkill
- brainstormingSkill
- doc-auditSkill
- feature-deliverySkill
- find-skillsSkill
- frontend-designSkill
- hotfixSkill
- jules-tasksSkill
- release-readinessSkill
- requesting-code-reviewSkill
- setup-repoSkill
- skill-creatorSkill
- systematic-debuggingSkill
- using-superpowersSkill
- writing-plansSkill
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 3 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈3
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 19
Ask user for scope before starting:
- Distinctive: line 28
Read ALL source lines — no skipping
- Distinctive: line 29
Check ALL rule files listed below
- Very specific: line 108
Update docs/QA-CHECKLIST.md if new check categories are discovered.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
QA-Audit
<!-- SETUP: Fill in [FILL: ...] placeholders to match your project. -->Systematic full-scope quality audit for
[FILL: main-source-file]and its config ecosystem.
Overview
This skill performs a comprehensive code quality audit covering security, robustness, rule compliance, and documentation drift. It produces a structured report with findings classified by severity.
Scope Options
Ask user for scope before starting:
| Scope | Coverage |
| Source-only | Main source file |
| Config-included | Source + all config files |
| Full Scope Paranoid | Source + Config + Agent Rules + Docs (recommended, default) |
Key requirements:
- Read ALL source lines — no skipping
- Check ALL rule files listed below
- Report findings with exact line numbers and the specific rule violated
- Save report as
docs/QA-AUDIT-{YYYY-MM-DD}.md - No fixes until user approves — audit is read-only first
When to Use
- Periodic audits — after major features or before releases
- Security review — when checking for XSS, injection, or unsafe data flows
- Post-refactor verification — when code changed significantly
- Rule compliance check — when verifying code follows all project conventions
- Documentation drift detection — when code values may have changed without updating docs
- Pre-release quality gate — as part of the release-readiness workflow
The 9-Phase Process
| Phase | Focus | Output |
| 0 | Baseline — Run npm test and config/asset verification | Green baseline confirmed |
| 1 | Source Full Read — Every line of the main source file | Zone-by-zone understanding |
| 2 | Rule Compliance — Compare code against ALL rule files | Rule violation findings |
| 3 | Config Verification — Schema conformity, cross-references | Schema/data integrity findings |
| 4 | Security Scan — innerHTML/XSS, forbidden APIs | Security findings |
| 5 | Edge-Case & Robustness — Race conditions, error propagation, guards | Robustness findings |
| 6 | Documentation Drift — Code IST vs. documented SOLL values | Drift findings |
| 7 | Classification & Report — Severity assignment, structured audit document | QA-AUDIT-{date}.md |
| 8 | Fix Planning — Risk per finding, fix order, verification plan | Fix roadmap |
Severity Definitions
| Severity | Criteria | Examples |
| CRITICAL | Security vulnerability or data loss risk | XSS via innerHTML, credential exposure |
| HIGH | Functional bug affecting users | UI freeze, broken navigation, lost state |
| MEDIUM | Rule violation, robustness gap, doku drift | Missing guard, wrong value in docs |
| LOW | Code hygiene, dead code, inconsistency | Unused variable, redundant style |
Key Checks (Quick Reference)
Security
- All
innerHTMLwith config-/runtime-derived text uses a safe escaping function - No
eval(),Function(),document.write(),postMessage,localStorage - [FILL: Project-specific security check]
Rule Compliance
- [FILL: Rule 1 — e.g. "touch-action: manipulation on every interactive element"]
- [FILL: Rule 2 — e.g. ":hover only inside @media (hover: hover) and (pointer: fine)"]
- [FILL: Rule 3 — e.g. "All config uses IIFE + Object.freeze"]
- Relative paths only — no leading
/or./(if applicable)
Robustness
- [FILL: Race condition check 1]
- [FILL: Error propagation check]
- Compatibility guard covers all required APIs
Documentation Drift
- [FILL: Key value that must match across all rule files]
- Immutable contract IDs are unchanged
Rule Files to Check (ALL of these)
| File | Key sections |
AGENTS.md | Coding Rules, Immutable Contract |
CLAUDE.md | Critical Constraints, Do NOT |
.github/copilot-instructions.md | Always Do, Never Do |
.agent/rules/coding-standards.md | Rules, conventions |
| [FILL: additional rule files] | [FILL: scope] |
Report Output
Save to: docs/QA-AUDIT-{YYYY-MM-DD}.md
Update docs/QA-CHECKLIST.md if new check categories are discovered.
Full Procedure
→ See .agent/workflows/qa-audit.md for the complete step-by-step guide.
→ For Claude Code users: use the /qa-audit slash command.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.