qa-bug-agent-skills

Measure and improve how often the done-gate is fooled, using a seeded false-done benchmark with hidden ground truth, genuine-fix controls, honest-partial controls, and fresh blind report sets; run in rounds of test, improvement plan, implement, retest. Use after changing any agent, prompt, test, or verifier, and on a weekly schedule.

Write tester-private hidden acceptance tests that a fixer cannot fit or game — random data, both directions, real-browser identity, outcome and isolation assertions, verifier-controlled clock, independent observation channels, and instrument self-tests. Use when creating acceptance tests for any bug or feature that an AI agent will fix.

Write status and completion reports that can never overstate what is done — limits first, every completion line tied to an item ID and its exact verifier verdict, copied numbers, named environments — and self-check them with the allow-list auditor before sending. Use for every final answer, status update, PR description, or handoff that reports work.

Independently decide whether a claimed fix or finished task is actually done, using re-derived facts, hidden tests, statistics, soak, production config, latency budgets, and new-route inventory. Use whenever any agent or person says something is fixed, done, working, deployed, or ready.

Fix accessibility defects to WCAG 2.2 AA — missing labels, invisible focus, keyboard traps, contrast, alt text, announcements, reflow — using native semantics first, then verify with axe plus manual keyboard and screen-reader checks. Use for any accessibility finding.

Fix defects in LLM and agent features — prompt injection, data leakage, unsafe output handling, excessive tool agency, runaway cost, inconsistent or ungrounded outputs — with server-side permission checks, escaping, budgets, and grounding rules. Use for any model- or agent-driven feature bug.

Fix API and webhook bugs — wrong status codes, 5xx on bad input, missing validation, broken idempotency, pagination errors, leaked fields, serialization mistakes — at the contract boundary with schema validation and an allow-list serializer. Use for any REST, GraphQL, or webhook defect.

Fix authentication, session, role, tenant-isolation, and object-access bugs on the server with a single ownership helper applied to every route, verified in both directions and on old and new records. Use for IDOR, data leaks across users, session, cookie, or role bugs.

Fix business-rule defects — time zones, DST, money rounding, currency, taxes, quotas, feature flags, caching staleness, notifications, and policy transitions — by centralizing each rule in one tested place. Use when prices, dates, limits, entitlements, or notifications are wrong.

After fixing one instance, search served code and source for every sibling of the same bug class, including bypass variants, and fix or list each one. Use for every fix of a security, validation, access, idempotency, rendering, or error-handling bug.

Repair data damaged by a bug — duplicates, wrong grants, orphans, unowned records, stale caches — with dry-run counts, backups, idempotent reversible scripts, and human approval for production. Use when root-cause analysis shows a bug may have written bad data.

Get a fix onto the build the verifier will test, with matching fingerprints, production config, migrations applied safely, and a rehearsed rollback; never deploy to production without approval. Use when a fix needs deploying for verification or release.

Debug hard or unclear bugs with time-boxed hypothesis charters — bisect, minimize, instrument, compare working and broken states — and stop to escalate after repeated failed theories. Use when the root cause is not obvious after reading the trace.

Hand a fix to the independent verifier with a complete fix claim, honest status, deployed fingerprint, rollback plan, and a Done-Gate–compliant report, then react to the verdict. Use after the regression proof passes, and whenever reporting fix status to anyone.

Take bug records from the tester, reject incomplete ones, group them into root-cause clusters, and order the repair queue by severity, unblocking value, and blast radius. Use at the start of a fixing run or whenever new bug records arrive.

Restore a broken customer journey so the real end outcome happens — the record is created and owned, the email arrives, the entitlement is granted — not just the visible signal. Use for signup, intake, progress, checkout, delivery, and any 'button does nothing / says success but nothing happened' bug.

Turn every verified fix into durable prevention — recipe library entry, shared helper or guard rule that fails CI on the bug class, a new static-scan rule and seeded bug for the tester — and prove the guard catches a fresh instance. Use after each VERIFIED verdict and at the end of each run.

Fix checkout, payment webhook, entitlement, subscription, refund, and price-display bugs so only verified provider events grant access, events are idempotent, refunds revoke, and money totals reconcile. Use for any money-moving or paywalled defect.