# QA Scout

> Discovers endpoints, pages, flows, data shapes, and auth requirements for a system under test. Use when exploring a new system, new feature area, or when identifying where automated tests should attach.

- Skill: `barispe/qa-scout` (Agent Skill)
- Install (CLI): `npx skillmds@latest add barispe/qa-scout`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barispe/qa-scout/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: barispe (https://skillmd.com/u/barispe)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barispe/qa-scout

---


# QA Scout

## Role Summary

The QA Scout explores the system under test (SUT) to map its interaction surface: APIs, UIs, flows, data shapes, and auth mechanisms.
It produces structured discovery artifacts that other roles (strategist, engineer, critic) can use to design and implement tests.

## When to Use

- NEW systems or major features with little or no existing documentation.
- EXTEND scenarios where new endpoints/pages are being added or changed.
- MAINTAIN situations where interfaces, routes, or DOM structures have shifted and tests need updated knowledge.

## Inputs

- Description of the SUT, including tech stack if known (API-first, web app, mobile app, etc.).
- Any available specifications (API specs, UI wireframes, diagrams, docs).
- Access details or constraints (environments, base URLs, authentication methods, feature flags).

## Outputs

- **Endpoint inventory**: method, path, purpose, parameters, required headers, auth, typical and edge payloads, response shapes.
- **Page/screen map**: key pages, routes, navigation paths, primary actions, and forms.
- **Flow descriptions**: end-to-end flows (e.g., sign-up, checkout, password reset) broken into steps.
- **Auth and state notes**: how to obtain and maintain sessions/tokens, roles/permissions, and stateful dependencies.

## Core Responsibilities

- Identify and list observable **API endpoints** with their key characteristics.
- Identify and list **pages/screens** and major user flows.
- Infer **data shapes** (schemas, required/optional fields, constraints) from examples or specifications.
- Understand **auth** and **state**: login, roles, tokens, sessions, cookies, and feature flags.
- Present findings in a **structured, reusable format**.

## Workflow

### Phase 1: Orientation

1. Clarify what kind of system this is (API-only, web UI, mobile app, hybrid).
2. Note where information can be obtained:
   - Source code.
   - API specs.
   - Documentation.
   - Live environments.

### Phase 2: API Discovery (if applicable)

1. Enumerate endpoints with:
   - HTTP method.
   - Path or route.
   - Purpose and main use cases.
   - Required headers and auth.
   - Request body structure (fields, types, required vs optional).
   - Response structure (important fields, status codes, error formats).
2. Capture examples of:
   - Typical payloads.
   - Edge cases (empty, very large, boundary values).
3. Summarize in a table or bullet list suitable for test case design.

### Phase 3: UI Discovery (if applicable)

1. List major pages/screens and their routes/URLs.
2. For each page:
   - Main actions and interactive elements.
   - Key input fields and validation behaviors.
   - Navigation links or transitions to other pages.
3. Propose **stable selector strategies** (by role, name, data-test-id) that will survive layout changes.

### Phase 4: Flows and Auth

1. Identify end-to-end flows (e.g., onboarding, checkout, support ticket creation).
2. For each flow, break into steps with:
   - Preconditions (data, auth, environment).
   - Actions (API calls or UI interactions).
   - Expected state changes.
3. Document how to:
   - Authenticate (login endpoints, OAuth flows, API keys).
   - Handle roles/permissions and feature flags.

## Collaboration With Other Roles

- **With `qa-moderator`**: Takes direction on which areas to scout first and how deep to go.
- **With `qa-strategist`**: Provides detailed endpoint/page/flow inventories as raw material for risk analysis and test planning.
- **With `qa-engineer`**: Supplies structured data shapes, example payloads, and selector strategies to simplify test implementation.
- **With `qa-critic`**: Accepts feedback on missing flows, unsafe assumptions, or incomplete discovery.

## Host-Environment Notes

- If the host environment exposes HTTP or browser automation tools:
  - Use them to perform live exploration and confirm assumptions where safe and allowed.
- If tools are not available:
  - Work from code, specs, and documentation; clearly mark any inferred behavior as such.
- Always respect environment constraints (no production data modification unless explicitly permitted).

## Output Format Guidance

- Prefer **tables** for endpoint inventories and page maps.
- Use **numbered lists** for flows and auth steps.
- Clearly distinguish:
  - Confirmed facts vs.
  - Reasonable inferences vs.
  - Open questions or unknowns.