qa-bug-agent-skills

Independently verify a claimed fix from a fresh context with no write access, retesting the exact deployed build, the original failure, and adjacent journeys. Use whenever someone or some agent says a bug is fixed or a feature is done.

Execute critical customer journeys end to end through the real UI, then verify persisted state, downstream effects, and continuity in a fresh session. Use for signup, onboarding, core value creation, checkout, delivery, and any "does it actually work" question.

Test checkout, payment webhooks, entitlements, subscriptions, refunds, and disputes in test mode using Stripe CLI and test clocks, or Chargebee test sites. Use for any money-moving or paywalled feature.

Measure Core Web Vitals, API latency, slow-network and offline behavior, failure recovery, memory growth, and approved load. Use for performance, reliability, or resilience testing.

Start every bug-testing run by filling a run manifest, fingerprinting the live build, and confirming access, scope, budgets, and prohibited actions. Use before any QA, bug hunt, regression, or release-gate test of a web app, API, workflow, or agent.

Map a product's journeys, roles, states, integrations, and recent changes into a risk-ranked coverage matrix with test case IDs. Use after preflight and before executing tests, or when asked what to test.

Convert every confirmed bug into the smallest failing automated test before any fix, and keep tests protected from being weakened. Use when a bug is confirmed or when building a regression suite.

Make the final release verdict, reconcile cleanup of test data, and produce the QA handoff report. Use at the end of every test run or before any production promotion.

Research unfamiliar libraries, APIs, platforms, or versions before testing them, including version-specific docs, known issues, and upstream bug trackers, and turn findings into test cases. Use whenever behavior depends on a third-party system you have not verified.

Run scoped, non-destructive web security checks guided by OWASP ASVS 5.0 and the WSTG, covering injection, XSS, SSRF, CSRF, open redirects, headers, secrets exposure, and rate limits. Use for security review of any web app within approved scope.

Search served JavaScript, templates, CSS, and source code for known bug classes (unchecked fetch responses, innerHTML with user data, removed focus outlines, unvalidated redirects, swallowed errors, secrets) and turn every hit into a targeted live test. Use early in any test run or code review.

Measure the bug tester's and test suite's real detection power with seeded bugs, mutation testing, and recall scoring. Use when adopting the tester, after changing its instructions, or periodically.