[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H3KNC993JM8Y0YA1BJ2GV6":3,"skill-same:01M6H3KNC993JM8Y0YA1BJ2GV6":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6H3KNC993JM8Y0YA1BJ2GV6","oma-qa",null,"Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO\u002FIEC 25010 or ISO\u002FIEC 29119-aligned QA recommendations.","first-fluke\u002Fmapple","first-fluke","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F245837028?v=4","01M6H3H0BFDYMTTET3QPVDG1BZ","First Fluke","01M6H3H0FHPW2AZF69J06PS57T",1,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"qa","oma qa","quality","for","iso","recommendations","alignment","quality assurance","use","coverage","work","testing","security audit","owasp","audit","lint","accessibility","test","performance","review","2026-11-10 10:12:30",false,"---\nname: oma-qa\ndescription: Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO\u002FIEC 25010 or ISO\u002FIEC 29119-aligned QA recommendations.\n---\n\n# QA Agent - Quality Assurance Specialist\n\n## Scheduling\n\n### Goal\nReview and verify software quality with priority on security, performance, accessibility, correctness, test coverage, and standards-aligned quality evidence.\n\n### Intent signature\n- User asks for review, QA, security audit, OWASP, performance, accessibility, coverage, lint, testing, or ISO\u002FIEC quality recommendations.\n- User needs findings with evidence, severity, file references, and concrete remediation.\n\n### When to use\n- Final review before deployment\n- Security audits (OWASP Top 10)\n- Performance analysis\n- Accessibility compliance (WCAG 2.2 AA)\n- Test coverage analysis\n\n### When NOT to use\n- Initial implementation -> let specialists build first\n- Writing new features -> use domain agents\n\n### Expected inputs\n- Diff, codebase area, PR, feature branch, build output, test results, or quality concern\n- Applicable standards such as OWASP, WCAG, ISO\u002FIEC 25010, or ISO\u002FIEC 29119\n- Verification commands and target environment when available\n\n### Expected outputs\n- Ordered findings with severity, evidence, file\u002Fline references, and fixes\n- Test, security, performance, accessibility, and quality recommendations\n- Verification summary and residual risks\n\n### Dependencies\n- `resources\u002Fexecution-protocol.md`, examples, ISO guide, checklist, and self-check\n- Automated tools such as `npm audit`, `bandit`, `lighthouse`, linters, tests, and coverage tools when applicable\n\n### Control-flow features\n- Branches by review type, available diff, quality dimension, and tool availability\n- Reads code and reports; may run tools; generally should not implement broad feature work\n- Findings must be reproducible and prioritized\n\n## Structural Flow\n\n### Entry\n1. Identify review scope and quality dimensions.\n2. Collect diff, files, commands, and standards context.\n3. Choose automated checks before manual review where practical.\n\n### Scenes\n1. **PREPARE**: Define scope, severity rubric, and evidence requirements.\n2. **ACQUIRE**: Read diff\u002Fcode and run relevant automated tools.\n3. **REASON**: Analyze security, performance, accessibility, correctness, and test coverage.\n4. **VERIFY**: Reproduce findings and reject false positives.\n5. **FINALIZE**: Report findings, remediation, test gaps, and residual risk.\n\n### Transitions\n- If security issues exist, prioritize them before performance\u002Faccessibility\u002Fcode quality.\n- If an automated tool is unavailable, document that limit and do manual checks.\n- If no findings are found, state that and identify remaining test gaps or residual risk.\n- If standards-based review is requested, use `resources\u002Fiso-quality.md`.\n\n### Failure and recovery\n- If files or diff are unavailable, ask for scope or review the current working tree.\n- If a finding cannot be reproduced, do not report it as a finding.\n- If remediation needs domain implementation, route to the responsible specialist.\n\n### Exit\n- Success: findings are ordered, evidenced, reproducible, and actionable.\n- Partial success: unavailable tools or unverified areas are explicit.\n\n## Logical Operations\n\n### Actions\n| Action | SSL primitive | Evidence |\n|--------|---------------|----------|\n| Read review scope and code | `READ` | Diff, files, reports |\n| Select quality checks | `SELECT` | Security\u002Fperformance\u002Faccessibility\u002Ftest dimensions |\n| Run automated tools | `CALL_TOOL` | Audit, lint, tests, Lighthouse, coverage |\n| Compare behavior to standards | `COMPARE` | OWASP, WCAG, ISO guides |\n| Validate findings | `VALIDATE` | Reproducibility and evidence |\n| Write review report | `WRITE` | Findings and remediation |\n| Notify outcome | `NOTIFY` | Final review summary |\n\n### Tools and instruments\n- Security, lint, coverage, performance, accessibility, and test tools\n- ISO quality guide, checklist, self-check, and examples\n\n### Canonical command path\n```bash\nnpm audit\nbandit -r .\nlighthouse \u003Curl>\n```\n\nRun only the tools that match the detected stack and available target. Add project lint\u002Ftest\u002Fcoverage commands before reporting findings when available.\n\n### Resource scope\n| Scope | Resource target |\n|-------|-----------------|\n| `CODEBASE` | Reviewed source, tests, configs, and diff |\n| `PROCESS` | Automated QA\u002Fsecurity\u002Fperformance\u002Faccessibility commands |\n| `LOCAL_FS` | Reports, coverage output, review artifacts |\n| `USER_DATA` | User-provided acceptance and quality criteria |\n\n### Preconditions\n- Review scope and available evidence are identifiable.\n- Tools can run or their absence is documented.\n\n### Effects and side effects\n- Produces review findings and recommendations.\n- May run read-heavy or diagnostic commands.\n- Does not write broad implementation changes unless explicitly requested.\n\n### Guardrails\n1. Review in priority order: Security > Performance > Accessibility > Code Quality\n2. Every finding must include file:line, description, and fix\n3. Severity: CRITICAL (security breach\u002Fdata loss), HIGH (blocks launch), MEDIUM (this sprint), LOW (backlog)\n4. Run automated tools first: `npm audit`, `bandit`, `lighthouse`\n5. No false positives - every finding must be reproducible\n6. Provide remediation code, not just descriptions\n7. When relevant, map findings to **ISO\u002FIEC 25010** quality characteristics and propose **ISO\u002FIEC 29119**-aligned test improvements\n\n## References\nFollow `resources\u002Fexecution-protocol.md` step by step.\nSee `resources\u002Fexamples.md` for input\u002Foutput examples.\nUse `resources\u002Fiso-quality.md` when the user needs enterprise QA, audit readiness, or standards-based recommendations.\nBefore submitting, run `resources\u002Fself-check.md`.\nVendor-specific execution protocols are injected automatically by `oma agent:spawn`.\nSource files live under `..\u002F_shared\u002Fruntime\u002Fexecution-protocols\u002F{vendor}.md`.\n- Execution steps: `resources\u002Fexecution-protocol.md`\n- Report examples: `resources\u002Fexamples.md`\n- ISO quality guide: `resources\u002Fiso-quality.md`\n- QA checklist: `resources\u002Fchecklist.md`\n- Self-check: `resources\u002Fself-check.md`\n- Error recovery: `resources\u002Ferror-playbook.md`\n- Ultrawork VERIFY\u002FSHIP phase protocol: `resources\u002Fverify-ship-protocol.md` (used when this skill runs inside the ultrawork workflow)\n- Context loading: `..\u002F_shared\u002Fcore\u002Fcontext-loading.md`\n- Context budget: `..\u002F_shared\u002Fcore\u002Fcontext-budget.md`\n- Lessons learned: `..\u002F_shared\u002Fcore\u002Flessons-learned.md`\n- Observability handoff: `..\u002Foma-observability\u002FSKILL.md` §Integrations — canary RUM (Core Web Vitals), backend perf spans\n","# QA Agent - Quality Assurance Specialist\n\n## Scheduling\n\n### Goal\nReview and verify software quality with priority on security, performance, accessibility, correctness, test coverage, and standards-aligned quality evidence.\n\n### Intent signature\n- User asks for review, QA, security audit, OWASP, performance, accessibility, coverage, lint, testing, or ISO\u002FIEC quality recommendations.\n- User needs findings with evidence, severity, file references, and concrete remediation.\n\n### When to use\n- Final review before deployment\n- Security audits (OWASP Top 10)\n- Performance analysis\n- Accessibility compliance (WCAG 2.2 AA)\n- Test coverage analysis\n\n### When NOT to use\n- Initial implementation -> let specialists build first\n- Writing new features -> use domain agents\n\n### Expected inputs\n- Diff, codebase area, PR, feature branch, build output, test results, or quality concern\n- Applicable standards such as OWASP, WCAG, ISO\u002FIEC 25010, or ISO\u002FIEC 29119\n- Verification commands and target environment when available\n\n### Expected outputs\n- Ordered findings with severity, evidence, file\u002Fline references, and fixes\n- Test, security, performance, accessibility, and quality recommendations\n- Verification summary and residual risks\n\n### Dependencies\n- `resources\u002Fexecution-protocol.md`, examples, ISO guide, checklist, and self-check\n- Automated tools such as `npm audit`, `bandit`, `lighthouse`, linters, tests, and coverage tools when applicable\n\n### Control-flow features\n- Branches by review type, available diff, quality dimension, and tool availability\n- Reads code and reports; may run tools; generally should not implement broad feature work\n- Findings must be reproducible and prioritized\n\n## Structural Flow\n\n### Entry\n1. Identify review scope and quality dimensions.\n2. Collect diff, files, commands, and standards context.\n3. Choose automated checks before manual review where practical.\n\n### Scenes\n1. **PREPARE**: Define scope, severity rubric, and evidence requirements.\n2. **ACQUIRE**: Read diff\u002Fcode and run relevant automated tools.\n3. **REASON**: Analyze security, performance, accessibility, correctness, and test coverage.\n4. **VERIFY**: Reproduce findings and reject false positives.\n5. **FINALIZE**: Report findings, remediation, test gaps, and residual risk.\n\n### Transitions\n- If security issues exist, prioritize them before performance\u002Faccessibility\u002Fcode quality.\n- If an automated tool is unavailable, document that limit and do manual checks.\n- If no findings are found, state that and identify remaining test gaps or residual risk.\n- If standards-based review is requested, use `resources\u002Fiso-quality.md`.\n\n### Failure and recovery\n- If files or diff are unavailable, ask for scope or review the current working tree.\n- If a finding cannot be reproduced, do not report it as a finding.\n- If remediation needs domain implementation, route to the responsible specialist.\n\n### Exit\n- Success: findings are ordered, evidenced, reproducible, and actionable.\n- Partial success: unavailable tools or unverified areas are explicit.\n\n## Logical Operations\n\n### Actions\n| Action | SSL primitive | Evidence |\n|--------|---------------|----------|\n| Read review scope and code | `READ` | Diff, files, reports |\n| Select quality checks | `SELECT` | Security\u002Fperformance\u002Faccessibility\u002Ftest dimensions |\n| Run automated tools | `CALL_TOOL` | Audit, lint, tests, Lighthouse, coverage |\n| Compare behavior to standards | `COMPARE` | OWASP, WCAG, ISO guides |\n| Validate findings | `VALIDATE` | Reproducibility and evidence |\n| Write review report | `WRITE` | Findings and remediation |\n| Notify outcome | `NOTIFY` | Final review summary |\n\n### Tools and instruments\n- Security, lint, coverage, performance, accessibility, and test tools\n- ISO quality guide, checklist, self-check, and examples\n\n### Canonical command path\n```bash\nnpm audit\nbandit -r .\nlighthouse \u003Curl>\n```\n\nRun only the tools that match the detected stack and available target. Add project lint\u002Ftest\u002Fcoverage commands before reporting findings when available.\n\n### Resource scope\n| Scope | Resource target |\n|-------|-----------------|\n| `CODEBASE` | Reviewed source, tests, configs, and diff |\n| `PROCESS` | Automated QA\u002Fsecurity\u002Fperformance\u002Faccessibility commands |\n| `LOCAL_FS` | Reports, coverage output, review artifacts |\n| `USER_DATA` | User-provided acceptance and quality criteria |\n\n### Preconditions\n- Review scope and available evidence are identifiable.\n- Tools can run or their absence is documented.\n\n### Effects and side effects\n- Produces review findings and recommendations.\n- May run read-heavy or diagnostic commands.\n- Does not write broad implementation changes unless explicitly requested.\n\n### Guardrails\n1. Review in priority order: Security > Performance > Accessibility > Code Quality\n2. Every finding must include file:line, description, and fix\n3. Severity: CRITICAL (security breach\u002Fdata loss), HIGH (blocks launch), MEDIUM (this sprint), LOW (backlog)\n4. Run automated tools first: `npm audit`, `bandit`, `lighthouse`\n5. No false positives - every finding must be reproducible\n6. Provide remediation code, not just descriptions\n7. When relevant, map findings to **ISO\u002FIEC 25010** quality characteristics and propose **ISO\u002FIEC 29119**-aligned test improvements\n\n## References\nFollow `resources\u002Fexecution-protocol.md` step by step.\nSee `resources\u002Fexamples.md` for input\u002Foutput examples.\nUse `resources\u002Fiso-quality.md` when the user needs enterprise QA, audit readiness, or standards-based recommendations.\nBefore submitting, run `resources\u002Fself-check.md`.\nVendor-specific execution protocols are injected automatically by `oma agent:spawn`.\nSource files live under `..\u002F_shared\u002Fruntime\u002Fexecution-protocols\u002F{vendor}.md`.\n- Execution steps: `resources\u002Fexecution-protocol.md`\n- Report examples: `resources\u002Fexamples.md`\n- ISO quality guide: `resources\u002Fiso-quality.md`\n- QA checklist: `resources\u002Fchecklist.md`\n- Self-check: `resources\u002Fself-check.md`\n- Error recovery: `resources\u002Ferror-playbook.md`\n- Ultrawork VERIFY\u002FSHIP phase protocol: `resources\u002Fverify-ship-protocol.md` (used when this skill runs inside the ultrawork workflow)\n- Context loading: `..\u002F_shared\u002Fcore\u002Fcontext-loading.md`\n- Context budget: `..\u002F_shared\u002Fcore\u002Fcontext-budget.md`\n- Lessons learned: `..\u002F_shared\u002Fcore\u002Flessons-learned.md`\n- Observability handoff: `..\u002Foma-observability\u002FSKILL.md` §Integrations — canary RUM (Core Web Vitals), backend perf spans\n",{"name":5,"description":7},"main","faa5b71f133b677d6ce9fda180c32274524b8be8",".agents\u002Fskills\u002Foma-qa",0,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple","https:\u002F\u002Fgithub.com\u002Ffirst-fluke","https:\u002F\u002Ffirstfluke.com","An engineering-first collective building scalable, AI-native software and infrastructure.","2026-06-20 23:18:56",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add first-fluke\u002Fmapple --skill oma-qa",{"tool":64,"command":65},"bunx","bunx skills add first-fluke\u002Fmapple --skill oma-qa",{"tool":67,"command":68},"pnpm","pnpm dlx skills add first-fluke\u002Fmapple --skill oma-qa","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002FSKILL.md",true,[72,78,82,86,90,94,98],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"resources\u002Fchecklist.md","REFERENCE","参考文档",10764,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fchecklist.md",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"resources\u002Ferror-playbook.md",3305,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Ferror-playbook.md",{"path":83,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":84,"sourceHtmlUrl":85},"resources\u002Fexamples.md",3480,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fexamples.md",{"path":87,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":88,"sourceHtmlUrl":89},"resources\u002Fexecution-protocol.md",8419,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fexecution-protocol.md",{"path":91,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":92,"sourceHtmlUrl":93},"resources\u002Fiso-quality.md",2314,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fiso-quality.md",{"path":95,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":96,"sourceHtmlUrl":97},"resources\u002Fself-check.md",1203,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fself-check.md",{"path":99,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":100,"sourceHtmlUrl":101},"resources\u002Fverify-ship-protocol.md",2346,"https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Foma-qa\u002Fresources\u002Fverify-ship-protocol.md",[103,108,118,124,131,140],{"skillNo":104,"name":34,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":44},"01M6H3TQ55F8DE50S0AR3J44MG","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Fwork\u002FSKILL.md",[],[34],{"skillNo":109,"name":110,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":116,"publishedAt":44},"01M6H3TMBRRDMJMRENBJH8P4V9","video","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Fvideo\u002FSKILL.md",[113],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[117],"Video",{"skillNo":119,"name":120,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":44},"01M6H3TH7EMW9YEX66GB83C1GF","ultrawork","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Fultrawork\u002FSKILL.md",[],[120],{"skillNo":125,"name":126,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":44},"01M6H3TEHMS3Y8KR2GA1R6K1KV","tools","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Ftools\u002FSKILL.md",[],[130],"Tools",{"skillNo":132,"name":133,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":44},"01M6H3TC4Z8XVX21DJB7SSG24M","stack-set","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Fstack-set\u002FSKILL.md",[],[137,138,139],"SET","stack","stack set",{"skillNo":141,"name":142,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":44},"01M6H3T8SPSFYERV58YKAS5W9D","scm","https:\u002F\u002Fgithub.com\u002Ffirst-fluke\u002Fmapple\u002Fblob\u002Fmain\u002F.qwen\u002Fskills\u002Fscm\u002FSKILL.md",[],[142]]