Loading...
Loading...
Found 74 Skills
API testing patterns with supertest, MSW, and Vitest. Covers integration testing for REST APIs, HTTP request mocking with Mock Service Worker v2, response assertions, schema validation, test organization, and framework-specific patterns for Express, Fastify, and Hono. Use when writing integration tests for REST APIs, mocking HTTP requests, or testing API endpoints. Use for api-test, supertest, msw, mock-service-worker, integration-test, http-mock, endpoint-test, request-test.
Design API testing plans and test cases covering REST/GraphQL/gRPC interfaces. Default output is Markdown, and Excel/CSV/JSON output can be requested. Use for API testing or api-testing.
Production-grade Playwright in TypeScript: Page Object Model, fixtures, auto-waiting, user-facing locators, parallel execution, CI integration, visual testing, accessibility. Includes explicit "do not" list for AI agents and 2025-2026 feature awareness. Use when: "Playwright," "browser testing," "E2E test," "end-to-end," "page object." Related: visual-testing, ci-cd-integration, api-testing, test-reliability, accessibility-testing.
Create and manage test data with factory patterns, fixture strategies, data anonymization, and synthetic data generation. Covers Fishery (TypeScript), FactoryBot (Ruby), Factory Boy (Python), database seeding, cleanup strategies, and GDPR-compliant data handling. Use when: "test data," "fixtures," "factories," "seed data," "synthetic data," "test database," "data anonymization." Not for: migration/integrity testing of the DB itself — use database-testing; environment provisioning and database branching strategy — use test-environments. Related: test-environments, database-testing, api-testing, unit-testing.
Implement consumer-driven contract testing with Pact-JS (v16). Covers consumer test writing, broker-driven provider verification, Pact Broker setup, can-i-deploy as a deployment gate, webhook-triggered verification, pending pacts, and schema-first vs consumer-first approaches (OpenAPI/Ajv, Schemathesis). Use when: "contract test," "Pact," "consumer-driven," "API contract," "provider verification," "can-i-deploy." Not for: stubbing or mocking a dependency to isolate a test — use service-virtualization; general REST/GraphQL endpoint assertions against your own API — use api-testing. Related: api-testing, service-virtualization, ci-cd-integration, test-environments.
Test AI/LLM features that ship in your product. Covers prompt regression testing, response quality evaluation, tool-call validation, hallucination and RAG grounding checks, nondeterministic-output strategies, red-team/safety scans, eval frameworks, and agent-as-target injection (indirect injection via tool output / RAG / scan reports, self-propagating payloads, data exfiltration via an agent) plus a bundled detector for untrusted content. Use when: "test our LLM feature," "prompt regression test," "eval framework," "hallucination test," "RAG grounding," "nondeterministic output," "AI feature testing," "red-team our chatbot," "indirect prompt injection," "agent reading untrusted tool output," "production AI quality." Not for: using AI to generate your own test code — use ai-test-generation. Not for: classifying CI failures with AI — use ai-bug-triage. Not for: EU AI Act / GDPR conformity of an AI feature — use compliance-testing. Not for: canary/flag rollout of an AI feature — use testing-in-production. Related: ai-test-generation, ai-qa-review, api-testing, compliance-testing, security-testing, risk-based-testing, test-data-management.
Validate that analytics and marketing tracking fire CORRECTLY: GA4/GTM dataLayer events, Meta/TikTok/LinkedIn pixels, and ad-tech tags. Covers building a tracking plan as the contract, intercepting collect-endpoint beacons and dataLayer.push in Playwright, asserting event name + params + values + timing + de-duplication, Consent Mode v2 gating, CI regression gating, and news-media events (article-view, scroll-depth, paywall). Use when: "test analytics tracking," "GA4 event test," "verify the pixel fires," "dataLayer test," "tracking plan," "Meta Pixel dedup," "scroll-depth tracking test," "gate tracking in CI." Not for: whether tracking is ALLOWED to fire under consent law (GDPR/CMP) — that is compliance-testing; this skill checks the data is CORRECT. SEO meta tags / structured data — out of scope. Related: compliance-testing, playwright-automation, api-testing, qa-project-context.
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
Use AI to write NEW test code from specs, PRDs, user stories, code diffs, bug reports, or OpenAPI specs. Staged pipeline: requirements extraction → risk analysis → coverage matrix → scenario generation → oracle design → test code → human review, with guardrails against hallucinated APIs and weak assertions. Use when: "generate tests from spec," "tests from PRD," "tests from user story," "auto-generate test cases," "AI write tests for me." Not for: testing AI/LLM features in your product — use ai-system-testing. Not for: auditing a pre-existing test suite you did not just generate — use ai-qa-review (Step 7 here only reviews tests THIS pipeline produced). Related: playwright-automation, unit-testing, api-testing, qa-project-context.
End-to-end testing of email-dependent flows — signup confirmation, password reset, magic-link login, OTP/MFA codes, and notification emails. Covers the capture-inbox decision tree (Mailpit, Mailosaur, MailSlurp, Ethereal), Playwright polling without fixed sleeps, regex extraction of links/OTPs from the email body, deterministic per-test addresses (plus-addressing, per-inbox), subject/from/header/link assertions, and SPF/DKIM/DMARC deliverability checks as a separate suite. Use when: "test the signup confirmation email," "password reset email test," "magic-link login test," "capture OTP from email," "Mailpit," "Mailosaur," "MailSlurp," "email arrives flaky in CI," "assert email subject/from/links." Not for: Sending transactional email from your app code, or API-only contract tests of an email provider — those are api-testing / app concerns. Email HTML rendering across clients (Outlook/Gmail dark mode) is out of scope (note it as a gap; use visual-testing or Litmus). Related: playwright-automation, api-testing, test-data-management, qa-project-context.
Decision framework for isolating every external dependency in a test suite: when to use in-process mocks, HTTP stubs (MSW, WireMock), record-replay, fault injection (Toxiproxy), or ephemeral real services (Testcontainers), and how to enforce that no real calls escape in CI. Use when: "mock service," "stub API," "fake service," "WireMock," "MSW," "Toxiproxy," "test isolation," "dependency management," "stub an external API in CI." Not for: consumer-driven contract verification (Pact, broker) — use contract-testing; standing up a full Docker Compose env or seed data — use test-environments; broad resilience/game-day fault campaigns — use chaos-engineering. Related: contract-testing, test-environments, api-testing, test-data-management, chaos-engineering.
Test payment and checkout flows end to end against PSP sandboxes — Stripe first, with the general pattern for Adyen/Braintree/PayPal. Covers Stripe test-mode card numbers and their decline codes, the 3DS/SCA challenge flow and its nested-iframe handling in Playwright, test clocks for subscription/billing-cycle simulation, webhook testing (stripe listen/trigger, signature verification, idempotency), failed/retried payments and refunds, and never using real cards. Use when: "test Stripe checkout," "payment test," "3DS test," "test webhook signature," "test subscription renewal," "test clock," "refund test," "decline card test," "checkout E2E." Not for: General API contract testing of non-payment endpoints — api-testing. PCI-DSS/regulatory compliance audit — compliance-testing. Related: api-testing, playwright-automation, compliance-testing, test-data-management, qa-project-context.