qa-bug-agent-skills

Fix performance regressions, slow endpoints, memory growth, flaky failures, and race conditions by finding the nondeterministic or slow cause, never by adding sleeps or retries, and prove it statistically under soak. Use when the tester reports FLAKY, intermittent 5xx, slow pages, or degradation over time.

Plan the smallest correct fix at the right trust boundary, listing siblings, callers, adjacent journeys, contract changes, data impact, rollback, and approvals before writing code. Use for every non-trivial fix and always for security, payment, auth, or data bugs.

Prove each fix with the five self-checks — tester test fails on base, passes on the fix, fails again with only the fix reverted, full suite and guards green, no protected files touched — plus fixer-owned extra tests, and save the evidence for the verifier. Use before handing any fix to the verifier.

Reproduce each bug on the exact base build before changing code by running the tester's regression test and confirming it fails for the reported reason; reject tests that pass on the buggy build. Use before every fix.

Research unfamiliar libraries, APIs, platforms, or versions before changing code that depends on them, using version-specific primary docs, changelogs, and upstream issues, and confirm with a small probe. Use whenever a fix relies on third-party behavior you have not verified.

Find the true root cause of a reproduced bug by tracing the full data and control path, asking why until reaching the decision that created the bad state, and checking history. Use after reproducing and before planning any fix.

Handle security bugs — data exposure, auth or payment bypass, SSRF, XSS, CSRF, open redirects, secrets, missing rate limits — with contain-first steps, server-side fixes using shared guards, bypass-variant sweeps, exploitation log review, and minimal disclosure. Use for any P0/P1 security finding.

Fix UI, layout, cross-browser, mobile, console-error, and broken-asset bugs at their cause, verified across the same viewport and engine matrix the tester used. Use for visual, responsive, Safari, touch, image, or front-end crash bugs.

Test WCAG 2.2 AA accessibility with axe-core plus manual keyboard, focus, screen-reader, contrast, and zoom checks. Use for any customer-facing UI.

Test LLM features, AI agents, tool calling, MCP servers, and RAG for prompt injection, data leakage, excessive agency, unsafe output handling, runaway cost, and output quality and consistency. Use for any product feature driven by a model or agent.

Test REST, GraphQL, and webhook APIs for contract conformance, input fuzzing, error semantics, idempotency, pagination, and rate limits using schema-driven and property-based tools. Use when an app exposes or consumes APIs or webhooks.

Test background jobs, queues, cron, workflow engines (n8n, Windmill, Sim), and email delivery for execution order, swallowed errors, retries, idempotency, drift between repo and live, and observability. Use when any part of a journey runs asynchronously.

Test authentication, sessions, roles, multi-tenant isolation, and object-level authorization, including IDOR, token tampering, magic links, and private content leakage through feeds, search, caches, and storage URLs. Use for any app with accounts or private data.

Test web UI across Chromium, Firefox, WebKit, mobile viewports, and real iOS Safari, capturing console errors, failed requests, layout overflow, broken images, and visual defects with screenshots and traces. Use for any UI, smoke, cross-browser, mobile, or visual testing.

Write, dedupe, and rank defect records with minimal repro steps, expected-versus-actual results, sanitized evidence, reproducibility counts, and root-cause confidence. Use whenever a test fails or an anomaly is found.

Verify persistence, constraints, migrations, duplicates, orphans, and cleanup of test data. Use when testing anything that writes data or after schema changes and deploys.

Verify deployments, database migrations, rollback, environment config, and drift between the repo and the live system. Use before and after any release, schema change, or infrastructure change.

Run time-boxed exploratory testing charters that hunt unknown unknowns through interruptions, odd states, concurrency, misuse, and persona shifts. Use after scripted coverage, or when the product is new or poorly specified.