📦

qa

Name: qa
Author: mattpocock

Content revision r2 Safe ⚙️ External commands

Run Conversational QA and File GitHub Issues

Bug reports often lack reproducible details and clear scope. This skill clarifies each report, applies project terminology, and files structured GitHub issues.

Supports: Claude Codex Code(CC)

🥉 77 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "qa" from https://skillstore.io/skills/mattpocock-qa.md and its manifest at https://skillstore.io/api/skills/mattpocock-qa/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mattpocock-qa.md Signed manifest GET /api/skills/mattpocock-qa/manifest Signed lockfile GET /api/skills/mattpocock-qa/lockfile

Test it

Using "qa". The profile form says it saved, but the display name returns after I reload.

Expected outcome:

Issue filed: Profile display name reverts after refresh. The body includes observed behavior, expected behavior, numbered reproduction steps, and the GitHub issue URL.

Using "qa". Checkout rejects valid addresses, shows no success message, and sometimes stays on the payment page.

Expected outcome:

Three focused issues are filed in dependency order. Each includes its own expected behavior, reproduction steps, blockers, and GitHub issue URL.

Security Audit

Safe

v5 • 7/23/2026 Open versioned report

One static finding is confirmed: line 49 directs the agent to create GitHub issues through an authenticated external command without preflight review. The other three findings are Markdown fences, not shell or Ruby execution. No prompt injection, exfiltration intent, or other semantic security issue was found.

Files scanned

131

Lines analyzed

Review items

False positives ignored

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:49

Ruby/shell backtick execution

Create issues with `gh issue create`. Do NOT ask the user to review first — just file and share URLs

Line 49 directs the agent to run the authenticated `gh issue create` command and explicitly removes preflight user review. This can create unintended external repository content.

Risk Factors

⚙️ External commands (4)

SKILL.md:49 SKILL.md:57-75 SKILL.md:75-83 SKILL.md:83-109

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/mattpocock-qa/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mattpocock-qa/security.svg)](https://skillstore.io/skills/mattpocock-qa?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mattpocock-qa?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mattpocock-qa/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mattpocock-qa.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

mattpocock. (2026). qa security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mattpocock-qa/audits/5

BibTeX citation

@techreport{mattpocock-mattpocock-qa-2026,
  author = {mattpocock},
  title = {qa security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/mattpocock-qa/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "qa security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "mattpocock"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/mattpocock-qa/audits/5"
identifiers:
  - type: other
    value: "skillstore:mattpocock-qa:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Convert Test Reports

Convert a tester's conversational bug report into a concise issue with expected behavior and reproduction steps.

Prepare Support Escalations

Turn customer-reported symptoms into developer-ready GitHub issues using the project's domain language.

Break Down Broad Defects

Split broad defects into ordered, independently actionable issues with explicit blockers.

Try These Prompts

Report a Clear Bug

Start a QA session. The settings page saves successfully, but my timezone resets after refresh.

Clarify an Intermittent Failure

Run QA for an intermittent checkout failure. Ask concise questions, then file one issue when reproduction details are sufficient.

Apply Project Terminology

Create a durable issue for duplicated imported records after synchronization retries. Explore project terminology before writing the issue.

Plan a Dependency Breakdown

Assess and file an ordered issue breakdown: validation fails, success feedback is missing, and redirect behavior is incorrect.

Best Practices

Provide concrete expected and actual outcomes with exact reproduction steps.
Confirm the active repository and issue destination before starting the session.
Share relevant conditions such as configuration, inputs, frequency, and environment.

Avoid

Do not use automatic filing for confidential reports that must not reach GitHub.
Do not combine unrelated symptoms into one broad issue.
Do not expect root-cause analysis or code fixes from this workflow.

Frequently Asked Questions

Does this skill write or change code?

No. It explores context only to improve issue wording and does not implement fixes.

Does it create GitHub issues automatically?

Yes. It uses the authenticated `gh issue create` command after collecting sufficient details.

Will it ask me to approve each issue?

No. The current workflow files issues without preflight review, so use it only when automatic filing is acceptable.

Can it split one report into several issues?

Yes. It separates independent failure modes and records genuine blocking relationships.

Why does it explore the codebase?

It learns product terminology, intended behavior, and user-facing boundaries for clearer issue descriptions.

What setup is required?

You need an authenticated GitHub CLI, an active repository, and permission to create issues.

Developer Details

Author

mattpocock

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/mattpocock/skills/tree/main/skills/deprecated/qa/

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/25/2026

Usage

1 downloads · 0 views

File structure

📄 SKILL.md