QA-Audit
Systematic full-scope quality audit for [FILL: main-source-file] and its config ecosystem.
Overview
This skill performs a comprehensive code quality audit covering security, robustness, rule compliance, and documentation drift. It produces a structured report with findings classified by severity.
Scope Options
Ask user for scope before starting:
| Scope |
Coverage |
| Source-only |
Main source file |
| Config-included |
Source + all config files |
| Full Scope Paranoid |
Source + Config + Agent Rules + Docs (recommended, default) |
Key requirements:
- Read ALL source lines — no skipping
- Check ALL rule files listed below
- Report findings with exact line numbers and the specific rule violated
- Save report as
docs/QA-AUDIT-{YYYY-MM-DD}.md
- No fixes until user approves — audit is read-only first
When to Use
- Periodic audits — after major features or before releases
- Security review — when checking for XSS, injection, or unsafe data flows
- Post-refactor verification — when code changed significantly
- Rule compliance check — when verifying code follows all project conventions
- Documentation drift detection — when code values may have changed without updating docs
- Pre-release quality gate — as part of the release-readiness workflow
The 9-Phase Process
| Phase |
Focus |
Output |
| 0 |
Baseline — Run npm test and config/asset verification |
Green baseline confirmed |
| 1 |
Source Full Read — Every line of the main source file |
Zone-by-zone understanding |
| 2 |
Rule Compliance — Compare code against ALL rule files |
Rule violation findings |
| 3 |
Config Verification — Schema conformity, cross-references |
Schema/data integrity findings |
| 4 |
Security Scan — innerHTML/XSS, forbidden APIs |
Security findings |
| 5 |
Edge-Case & Robustness — Race conditions, error propagation, guards |
Robustness findings |
| 6 |
Documentation Drift — Code IST vs. documented SOLL values |
Drift findings |
| 7 |
Classification & Report — Severity assignment, structured audit document |
QA-AUDIT-{date}.md |
| 8 |
Fix Planning — Risk per finding, fix order, verification plan |
Fix roadmap |
Severity Definitions
| Severity |
Criteria |
Examples |
| CRITICAL |
Security vulnerability or data loss risk |
XSS via innerHTML, credential exposure |
| HIGH |
Functional bug affecting users |
UI freeze, broken navigation, lost state |
| MEDIUM |
Rule violation, robustness gap, doku drift |
Missing guard, wrong value in docs |
| LOW |
Code hygiene, dead code, inconsistency |
Unused variable, redundant style |
Key Checks (Quick Reference)
Security
- All
innerHTML with config-/runtime-derived text uses a safe escaping function
- No
eval(), Function(), document.write(), postMessage, localStorage
- [FILL: Project-specific security check]
Rule Compliance
- [FILL: Rule 1 — e.g. "touch-action: manipulation on every interactive element"]
- [FILL: Rule 2 — e.g. ":hover only inside @media (hover: hover) and (pointer: fine)"]
- [FILL: Rule 3 — e.g. "All config uses IIFE + Object.freeze"]
- Relative paths only — no leading
/ or ./ (if applicable)
Robustness
- [FILL: Race condition check 1]
- [FILL: Error propagation check]
- Compatibility guard covers all required APIs
Documentation Drift
- [FILL: Key value that must match across all rule files]
- Immutable contract IDs are unchanged
Rule Files to Check (ALL of these)
| File |
Key sections |
AGENTS.md |
Coding Rules, Immutable Contract |
CLAUDE.md |
Critical Constraints, Do NOT |
.github/copilot-instructions.md |
Always Do, Never Do |
.agent/rules/coding-standards.md |
Rules, conventions |
| [FILL: additional rule files] |
[FILL: scope] |
Report Output
Save to: docs/QA-AUDIT-{YYYY-MM-DD}.md
Update docs/QA-CHECKLIST.md if new check categories are discovered.
Full Procedure
→ See .agent/workflows/qa-audit.md for the complete step-by-step guide.
→ For Claude Code users: use the /qa-audit slash command.
1---2name: qa-audit-33description: Use when performing a quality audit, security review, or robustness check. Covers XSS/innerHTML scanning, rule compliance verification, race condition analysis, config schema validation, and documentation drift detection. Produces a severity-classified report (Critical/High/Medium/Low).4---56# QA-Audit78<!-- SETUP: Fill in [FILL: ...] placeholders to match your project. -->910> Systematic full-scope quality audit for `[FILL: main-source-file]` and its config ecosystem.1112## Overview1314This skill performs a comprehensive code quality audit covering security, robustness, rule compliance, and documentation drift. It produces a structured report with findings classified by severity.1516## Scope Options1718Ask user for scope before starting:1920| Scope | Coverage |21| --- | --- |22| **Source-only** | Main source file |23| **Config-included** | Source + all config files |24| **Full Scope Paranoid** | Source + Config + Agent Rules + Docs (recommended, default) |2526**Key requirements:**271. Read ALL source lines — no skipping282. Check ALL rule files listed below293. Report findings with exact line numbers and the specific rule violated304. Save report as `docs/QA-AUDIT-{YYYY-MM-DD}.md`315. **No fixes until user approves** — audit is read-only first3233---3435## When to Use3637- **Periodic audits** — after major features or before releases38- **Security review** — when checking for XSS, injection, or unsafe data flows39- **Post-refactor verification** — when code changed significantly40- **Rule compliance check** — when verifying code follows all project conventions41- **Documentation drift detection** — when code values may have changed without updating docs42- **Pre-release quality gate** — as part of the release-readiness workflow4344## The 9-Phase Process4546| Phase | Focus | Output |47| --- | --- | --- |48| 0 | **Baseline** — Run `npm test` and config/asset verification | Green baseline confirmed |49| 1 | **Source Full Read** — Every line of the main source file | Zone-by-zone understanding |50| 2 | **Rule Compliance** — Compare code against ALL rule files | Rule violation findings |51| 3 | **Config Verification** — Schema conformity, cross-references | Schema/data integrity findings |52| 4 | **Security Scan** — innerHTML/XSS, forbidden APIs | Security findings |53| 5 | **Edge-Case & Robustness** — Race conditions, error propagation, guards | Robustness findings |54| 6 | **Documentation Drift** — Code IST vs. documented SOLL values | Drift findings |55| 7 | **Classification & Report** — Severity assignment, structured audit document | `QA-AUDIT-{date}.md` |56| 8 | **Fix Planning** — Risk per finding, fix order, verification plan | Fix roadmap |5758## Severity Definitions5960| Severity | Criteria | Examples |61| --- | --- | --- |62| **CRITICAL** | Security vulnerability or data loss risk | XSS via innerHTML, credential exposure |63| **HIGH** | Functional bug affecting users | UI freeze, broken navigation, lost state |64| **MEDIUM** | Rule violation, robustness gap, doku drift | Missing guard, wrong value in docs |65| **LOW** | Code hygiene, dead code, inconsistency | Unused variable, redundant style |6667## Key Checks (Quick Reference)6869### Security7071- All `innerHTML` with config-/runtime-derived text uses a safe escaping function72- No `eval()`, `Function()`, `document.write()`, `postMessage`, `localStorage`73- [FILL: Project-specific security check]7475### Rule Compliance7677- [FILL: Rule 1 — e.g. "touch-action: manipulation on every interactive element"]78- [FILL: Rule 2 — e.g. ":hover only inside @media (hover: hover) and (pointer: fine)"]79- [FILL: Rule 3 — e.g. "All config uses IIFE + Object.freeze"]80- Relative paths only — no leading `/` or `./` (if applicable)8182### Robustness8384- [FILL: Race condition check 1]85- [FILL: Error propagation check]86- Compatibility guard covers all required APIs8788### Documentation Drift8990- [FILL: Key value that must match across all rule files]91- Immutable contract IDs are unchanged9293## Rule Files to Check (ALL of these)9495| File | Key sections |96| --- | --- |97| `AGENTS.md` | Coding Rules, Immutable Contract |98| `CLAUDE.md` | Critical Constraints, Do NOT |99| `.github/copilot-instructions.md` | Always Do, Never Do |100| `.agent/rules/coding-standards.md` | Rules, conventions |101| [FILL: additional rule files] | [FILL: scope] |102103## Report Output104105Save to: `docs/QA-AUDIT-{YYYY-MM-DD}.md`106107Update `docs/QA-CHECKLIST.md` if new check categories are discovered.108109## Full Procedure110111→ See `.agent/workflows/qa-audit.md` for the complete step-by-step guide.112113→ For Claude Code users: use the `/qa-audit` slash command.
florian101010