testland/test-case-from-live-feature
Build-an-X workflow that produces a test-case matrix from a **live, undocumented feature** - running app at a URL, screen recording, screenshot, or verbal brief - by combining structured exploration (Playwright trace / DevTools / accessibility tree) with the four canonical heuristic test-design models bundled in references/ (Bach's HTSM / SFDPOT product elements, Whittaker's How-to-Break-Software attacks, Bolton's FEW HICCUPPS consistency oracles, ISO/IEC 25010 quality characteristics). Output is a structured case matrix, not an exploratory session charter. Use when there is no story, no AC, and no documentation - only a live feature - or as the heuristic reference layer for zero-documentation test design.
75
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
In `SKILL.md` Step 1 (“Probe the live feature”), the workflow ingests free text produced by an engineer verbal brief (Step 1 Source: “Verbal brief from an engineer”, marked as a quote/unconfirmed) as part of the LLM’s observation log that drives later heuristic test-case generation.
Where we found it
Verbal brief from an engineer
content-type · 4 sites
Step 1 instructs the LLM to ingest free text from an engineer's verbal brief into the observation log, which then drives heuristic test-case generation in Steps 2-3.
SKILL.md
37
| **Verbal brief from an engineer** | "It does X and Y" - capture *as a quote*, do not transcribe as fact | Mark as `[verbal, unconfirmed]` |
SKILL.md
63
### Verbal brief (engineer Slack message, 2026-05-10)
SKILL.md
64
- "It uses Stripe for cards and PayPal for wallets, and we have a feature flag `new_checkout_v2` defaulting on." [verbal, unconfirmed]
SKILL.md
128
| Transcribing the engineer's verbal brief as fact | The brief is the engineer's mental model; mental models leak. | Tag verbal input `[verbal, unconfirmed]` and probe it against the live surface in Step 1. |
- Audited
- Security analysis