skills.rest
javiruu
javiruuCOMMUNITY
Explore all skills by this author →
GitHub

oma-qa

Reviews code for security, performance, accessibility, and test coverage with severity-ranked findings.

Updated Mar 26, 2026
Search Tags:#code review#accessibility#owasp#security audit#wcag#test coverage#qa review
One-click install
npx skills add https://github.com/javiruu/viru-air --skill oma-qa-javiruu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oma-qa
Source: https://github.com/javiruu/viru-air/tree/main/.agents/skills/oma-qa
Command: npx skills add https://github.com/javiruu/viru-air --skill oma-qa-javiruu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? It provides a structured quality assurance review process that catches security vulnerabilities, performance regressions, accessibility violations, and test coverage gaps before deployment, with reproducible evidence and concrete remediation steps. ## Core Features & Use Cases - Security Audits: Checks OWASP Top 10 risks, authentication flaws, injection vectors, and dependency vulnerabilities using tools like npm audit and bandit. - Performance & Accessibility Review: Validates Core Web Vitals via Lighthouse and WCAG 2.2 AA compliance with prioritized findings. - Runtime Verification: Uses browser automation and curl-based API checks to detect stubbed features and broken user flows that static review misses. - Use Case: Before a production release, run a full pre-launch audit that produces a PASS/WARNING/FAIL report with CRITICAL-to-LOW severity findings, file:line references, and remediation code. ## Quick Start Ask the agent to perform a full QA review of your current branch or pull request before deployment, including security, performance, and accessibility checks.

Frequently Asked Questions about oma-qa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase before deployment?▼

Run automated tools first: npm audit for Node.js dependencies and bandit for Python code. Then review authentication, input validation, and data protection against the OWASP Top 10 checklist, documenting each finding with file:line references and severity.

What severity levels should a QA review report use?▼

Use four levels: CRITICAL for security breaches or data loss, HIGH for issues blocking launch, MEDIUM for sprint-level fixes, and LOW for backlog items. Overall status is FAIL if any CRITICAL or HIGH issue exists, WARNING for MEDIUM-only, and PASS otherwise.

Can static code review catch stubbed or broken features?▼

No, static review misses display-only features and broken user flows. Runtime verification with browser automation tools like click, fill, and network request inspection is required to confirm buttons trigger handlers and APIs return expected responses.

How do I check WCAG 2.2 AA accessibility compliance?▼

Verify the four principles: Perceivable (alt text, 4.5:1 contrast), Operable (keyboard navigation, visible focus), Understandable (clear labels and errors), and Robust (valid HTML, ARIA roles). Use Lighthouse snapshot audits and screen reader testing for confirmation.

What should I do when QA tools like Lighthouse are unavailable?▼

Document the tool as unavailable and fall back to manual review. For performance, statically check for N+1 queries, missing pagination, and large bundle imports, then flag the report with static_analysis_only and recommend metrics to measure later.

Related Skills

Explore More Software Engineering Skills→
dcossondcosson
157

code-review

Review code diffs for beads or features and generate formal severity-based reports.

Community
Advanced
GeekKingCloudGeekKingCloud
6

crucible

Coordinate release-hardening workflows across implementation, review, verification, and cleanup tasks.

Community
Advanced
LauughterLauughter

performance-optimization

Measure web performance with Lighthouse and RUM to identify and fix bottlenecks.

Community
Advanced
besync-labsbesync-labs
7

verification-loop

Automate end-to-end quality gate validation across build, lint, type checks, tests, coverage, and security scans.

Community
Advanced