Quality-Max/free-qa-skills

# Accessibility Check

Scan any web page for WCAG accessibility violations. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Check accessibility on https://..."
- "WCAG scan this page"
- "Is my site accessible?"

# Agentic App Risk Review

Find the security weaknesses in your own LLM or agent app before users — or attackers — do. Read-only: it flags risks, it doesn't change your code.

## Prerequisites

- **None.** Pure Claude Code — reads your repository directly, no MCP required.

## Trigger

- "Review my agent app for prompt injection"
- "Security review of my LLM integration"
- "Is my chatbot safe against jailbreaks / tool abuse?"

# API Security Scan

Find the security holes in your API design before they ship. Read-only: it flags issues with `file:line`, it doesn't change your code.

## Prerequisites

- **None.** Pure Claude Code — reads your OpenAPI/Swagger spec or route/handler code directly, no MCP required.

## Trigger

- "Security review my API / OpenAPI spec"
- "Check my endpoints for missing auth"
- "API security scan"

# Broken Link Scanner

Find every broken link on a page. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Find broken links on https://..."
- "Check for 404s on my site"
- "Scan links on this page"

# Cold Load Waterfall

See what actually happens on a first visit — the slow requests on the critical path. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Profile the cold load of https://..."
- "What's slow on first visit?"
- "Build a load waterfall for my site"

# Complexity Hotspots

Find the code most likely to hide bugs and resist change. No signup required.

## Prerequisites

- **None.** Pure Claude Code. Uses a metrics tool if present (`radon`, `eslint`
  complexity rule, `gocyclo`, `lizard`), otherwise estimates from structure.

## Trigger

- "Find the most complex code in this repo"
- "Where are the refactor hotspots?"
- "Which functions are too complex?"

# Console Error Scanner

Find JS errors and failed requests hiding in the browser console. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Check for console errors on https://..."
- "Find JS errors on my site"
- "Any broken requests on this page?"

# Cookie & Privacy Scan

See what a site stores and who it tells before you click "Accept". No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Cookie/privacy scan https://..."
- "What trackers are on my site?"
- "Am I setting cookies before consent?"

# Core Web Vitals

Measure the Core Web Vitals of any page using real browser performance APIs. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Check Core Web Vitals for https://..."
- "How's the LCP/CLS on my site?"
- "Web vitals audit mysite.com"

# Dead Code Scan

Find the code nobody calls anymore. No signup required.

## Prerequisites

- **None.** Pure Claude Code. Will use a static analyzer if present
  (`knip`, `ts-prune`, `vulture`, `deadcode`), otherwise reasons from grep + imports.

## Trigger

- "Find dead code in this repo"
- "Any unused exports / files?"
- "What can I safely delete?"

# Dependency Audit

Establish what will actually run, then separate verified vulnerability exposure from ordinary update drift. This skill is diagnostic and read-only.

## Prerequisites

- A local repository containing dependency or runtime declarations.
- Current web access when known-vulnerability, maintenance, or latest-version status must be verified. Without it, report those fields as **not assessed**.
- No scanner installation. An already-installed auditor may be used only when its data-handling behavior is known and compatible with the safety boundary below.

## Trigger

- "Audit my dependencies"
- "Check our PHP, Python, Java, Node.js, or Go packages"

# Diff Risk Review

A second pair of eyes on your uncommitted changes. No signup required.

## Prerequisites

- **None.** Pure Claude Code — works in any git repo, no MCP required.

## Trigger

- "Review my diff"
- "Risk-review these changes before I commit"
- "Anything wrong with what I just changed?"

# Error Handling Audit

Find the places where failures disappear silently. No signup required.

## Prerequisites

- **None.** Pure Claude Code — works in any repo, no MCP required.

## Trigger

- "Audit error handling in this repo"
- "Where are we swallowing errors?"
- "Check exception handling on my changes"

# Evidence Code Audit

Find actionable defects and show what supports each claim. An audit of one
subsystem is not a verdict on the entire repository.

## Prerequisites

- Local repository access. Git is needed only for an incremental branch audit.
- No packages, API keys, network access, or companion skills required.

## Trigger

- "Audit this codebase and show the evidence"
- "Audit this branch for risks introduced by the changes"

# Exploited Vulnerability Watch

Turn the changing vulnerability landscape into a small, asset-relevant action queue. This is a defensive, read-only watch—not an exploit scanner and not a claim that exposure proves compromise.

## Prerequisites

- Current web access to authoritative public sources.
- A time window, defaulting to changes since the last recorded review or the previous 7 days.
- Optional local, read-only evidence of products, runtimes, dependencies, images, and externally reachable services.

## Trigger

- "Check the latest exploited CVEs"
- "What new attacks should we care about this week?"

# Flaky Selector Scan

Find the selectors that will break on the next redesign. No signup required.

## Prerequisites

- **None.** Pure Claude Code — reads the test files directly, no MCP required.

## Trigger

- "Scan my tests for flaky selectors"
- "Which locators are brittle?"
- "Why do my UI tests keep breaking?"

# Form Validation Scan

Find out if your forms accept garbage. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Scan my forms for validation gaps"
- "Do my forms validate input?"
- "Form validation audit https://..."

# i18n & RTL Audit

Check whether your UI survives translation. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "i18n audit https://..."
- "Will my layout break when translated?"
- "Check RTL support on my site"

# IaC Misconfig Scan

Catch insecure infrastructure-as-code before it ships. Read-only: it flags misconfigurations with `file:line`, it doesn't change anything.

## Prerequisites

- **None.** Pure Claude Code — reads IaC files directly, no MCP required.

## Trigger

- "Scan my Dockerfile / Terraform / workflows for misconfigs"
- "Is my infrastructure-as-code secure?"
- "IaC security review"

# Invisible Ink

The code you reviewed isn't the code that runs.

A reviewer sees `if (role != "user")`. The compiler sees a string that ends somewhere
else entirely. An `admin` with a Cyrillic `а` is a different variable. A `SKILL.md`
can carry a sentence written in Unicode tag characters that no editor shows but an LLM
can read. This skill makes all of that visible.

## Prerequisites

- **None.** Python 3 runs the bundled read-only scanner [`scripts/invisible_ink.py`](scripts/invisible_ink.py).
  No MCP, no network, no packages.

# License Compliance Scan

Spot license conflicts in your dependency tree before they become a problem. Read-only and advisory — it flags risks, it doesn't change anything, and it is not legal advice.

## Prerequisites

- **None.** Pure Claude Code — reads dependency manifests and your `LICENSE` directly, no MCP required.

## Trigger

- "Check my dependency licenses"
- "Any license conflicts in this project?"
- "License compliance scan"

# Mixed Content Scan

Find insecure HTTP resources loaded on your HTTPS pages. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Mixed content scan https://..."
- "Any insecure resources on my HTTPS site?"
- "Why is my padlock showing 'not fully secure'?"

# Mr. Null

Your app has never met a user named Null. Mr. Null has met your app.

People really are called Null, there really is a country code `NO`, and someone will
paste `1E02` into your quantity box. This skill finds the places where a string that
happens to look like a keyword or a number gets treated as one.

## Prerequisites

- **Website mode:** Playwright MCP (comes with Claude Code).
- **Repository mode:** none. Reads local files directly.

## Trigger

# Page Weight Budget

Check whether a page fits a sane performance budget. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Check page weight for https://..."
- "Is my site too heavy?"
- "Performance budget audit mysite.com"

# Railway Exposure Audit

Map what a Railway deployment exposes and whether each boundary is intentional and protected. Public reachability, weak protection, vulnerability, and compromise are separate conclusions.

## Prerequisites

- A local repository and, when available, a user-supplied Railway project or deployment view.
- Current access to Railway's official networking documentation for platform semantics.
- Optional read-only provider access. The repository-only path must still produce useful results and explicit verification gaps.

## Trigger

- "Audit our Railway exposure"
- "Is our Railway database or Redis public?"

# Responsive Screenshots

Screenshot a page at every common viewport size. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Responsive screenshots of https://..."
- "How does my site look on mobile?"
- "Screenshot this page at different sizes"

# Script Quality Review

A green run is not a real test. Read the script. No signup required.

## Prerequisites

- **None.** Reads the test files directly. No MCP.

## Trigger

- "Are these generated tests real?"
- "Grade this script"
- "Does a green run mean it passed?"

# Scunthorpe Check

Your validator thinks José O'Brien is an attack.

Every other form check asks "does it accept garbage?" This one asks the opposite: does it
turn away real people? It covers apostrophes, accents, non-Latin scripts, one-word names,
plus-addressed emails, foreign postcodes, and towns that a lazy profanity filter blocks.
Each one is a customer who couldn't sign up and a support ticket nobody files.

## Prerequisites

- **Website mode:** Playwright MCP (comes with Claude Code).
- **Repository mode:** none. Reads local files directly.

# Secret Scan

Catch a leaked credential before it lands in git history. No signup required.

## Prerequisites

- **None.** Pure Claude Code — works in any repo, no MCP required.

## Trigger

- "Scan for hardcoded secrets"
- "Any leaked keys in my changes?"
- "Secret scan before I commit"

# Security Advisory Triage

Turn a vulnerability claim into an evidence-based applicability decision. A public post is a useful lead, not proof that a named system is affected or compromised.

## Prerequisites

- An advisory link, CVE/vendor identifier, product name, or quoted claim.
- Read-only access to local version/configuration evidence when the user wants a specific asset checked.
- Current web access for authoritative advisory research. If it is unavailable, mark affected-version conclusions unverified.

## Trigger

- "Are we affected by this CVE?"
- "Check this security advisory against our deployment"

# Security Audit

Coordinate the repository's focused security skills into one read-only review. Select only checks that apply to the target, preserve the evidence and limitations of each check, and never treat a risky setting as proof of a vulnerability or compromise.

## Prerequisites

- A local repository, a user-supplied URL, or both.
- Browser automation such as Playwright MCP only when the selected profile includes a website.
- Companion skills improve coverage when installed, but this skill must report missing checks rather than pretending they ran.

## Trigger

- "Run a security audit"
- "Review this repository for security risks"

# Security Headers Check

Grade the HTTP security headers of any website. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Check security headers on https://..."
- "Security headers scan mysite.com"
- "Is my site missing any security headers?"

# SEO Quick Check

Check basic SEO health of any page. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "SEO check https://..."
- "Check meta tags on my site"
- "Is my page SEO-friendly?"

# Test Quality Review

Audit whether your tests actually test anything. No signup required.

## Prerequisites

- **None.** Pure Claude Code — reads the test files directly, no MCP required.

## Trigger

- "Review the quality of my tests"
- "Are these tests actually testing anything?"
- "Audit my test suite for weak tests"

# Third-Party Bloat

Find out which third-party scripts are weighing your page down. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "What third-party scripts are slowing my site?"
- "Third-party bloat audit https://..."
- "Which trackers are on my page?"

# UI/UX Deficiency Scan

Find common UI/UX problems that hurt user experience. No signup required.

## Prerequisites

- **Playwright MCP** (comes with Claude Code)

## Trigger

- "Scan UX issues on https://..."
- "Check UI quality of my site"
- "Find design problems on this page"
- "UX review this URL"