ai-playbook 1.0.0

package/skills/qa/skill.md

@@ -0,0 +1,384 @@
+# 🤖 Quality Assurance (QA) Skill
+
+## Purpose
+
+This document defines the knowledge, capabilities, and best practices for designing, implementing, executing, and maintaining comprehensive quality assurance strategies that ensure software reliability, security, performance, and user satisfaction.
+
+The AI should be capable of designing test strategies, creating test plans, implementing automated tests, executing manual testing, identifying and documenting defects, and ensuring quality throughout the development lifecycle.
+
+---
+
+# Table of Contents
+
+1. QA Fundamentals
+2. Test Planning & Strategy
+3. Test Types & Methodologies
+4. Manual Testing
+5. Test Automation
+6. Defect Management
+7. Test Tools & Frameworks
+8. Performance Testing
+9. Security Testing
+10. Accessibility Testing
+11. Compatibility Testing
+12. Mobile Testing
+13. Test Data Management
+14. Continuous Quality
+15. Best Practices
+16. Deliverables
+
+---
+
+# 1. QA Fundamentals
+
+| Concept                | Description                              | Application                          |
+| ---------------------- | ---------------------------------------- | ------------------------------------ |
+| Quality Definition     | Meeting requirements and user expectations| Define quality metrics upfront        |
+| Test Levels           | Unit, integration, system, acceptance    | Use appropriate level for each test  |
+| Test Phases           | Analysis, design, execution, reporting   | Follow structured testing process    |
+| Risk-Based Testing    | Prioritize testing by risk level        | Focus on high-impact areas first     |
+| Coverage Metrics      | Code, functionality, requirements        | Track and report coverage clearly    |
+| Defect Life Cycle     | Log → Analyze → Fix → Verify → Close    | Maintain consistent tracking         |
+| Test Environment      | Production-like setup for testing        | Ensure representative environments   |
+
+---
+
+# 2. Test Planning & Strategy
+
+Develop test plans that include:
+
+* Scope and objectives
+* Test levels and types
+* Resource allocation
+* Schedule and timeline
+* Entry and exit criteria
+* Risk assessment
+* Assumptions and dependencies
+* Approval and sign-off
+
+---
+
+# 3. Test Types & Methodologies
+
+## Functional Testing
+* Positive and negative testing
+* Boundary value analysis
+* Equivalence partitioning
+* State transition testing
+* Use case testing
+
+## Non-Functional Testing
+* Performance testing
+* Load testing
+* Stress testing
+* Scalability testing
+* Security testing
+* Usability testing
+* Compatibility testing
+* Localization testing
+
+## Regression Testing
+* Full regression
+* Partial regression
+* Selective regression
+* Risk-based regression
+
+---
+
+# 4. Manual Testing
+
+Execute:
+
+* Test case execution
+* Exploratory testing
+* Ad-hoc testing
+* Usability testing
+* User acceptance testing
+* Smoke testing
+* Sanity testing
+* End-to-end testing
+
+Skills:
+
+* Test case design
+* Defect reporting
+* Attention to detail
+* Domain knowledge
+* Critical thinking
+* Documentation
+
+---
+
+# 5. Test Automation
+
+Automate:
+
+* Regression test suites
+* Smoke tests
+* API tests
+* UI tests
+* Data validation tests
+* Performance baseline tests
+
+Best practices:
+
+* Select appropriate tests to automate
+* Maintain stable test environments
+* Use page object models
+* Implement retry logic
+* Use data-driven testing
+* Version control test code
+* Regular maintenance
+
+---
+
+# 6. Defect Management
+
+Track:
+
+* Defect severity (critical, major, minor, trivial)
+* Defect priority (high, medium, low)
+* Defect status (new, assigned, fixed, verified, closed)
+* Root cause analysis
+* Defect trends and metrics
+
+Deliverables:
+
+* Defect reports
+* Defect summaries
+* Root cause analysis
+* Metrics and trends
+
+---
+
+# 7. Test Tools & Frameworks
+
+## Test Automation Tools
+* Selenium
+* Cypress
+* Playwright
+* TestNG
+* JUnit
+* Pytest
+* Postman
+
+## Test Management Tools
+* TestRail
+* Zephyr
+* qTest
+* Azure DevOps
+
+## Performance Tools
+* JMeter
+* LoadRunner
+* Gatling
+* Locust
+
+## Defect Tracking
+* Jira
+* Azure DevOps
+* Linear
+* GitHub Issues
+
+---
+
+# 8. Performance Testing
+
+Conduct:
+
+* Load testing
+* Stress testing
+* Soak testing
+* Spike testing
+* Volume testing
+* Endurance testing
+
+Measure:
+
+* Response time
+* Throughput
+* CPU usage
+* Memory usage
+* Network usage
+* Error rates under load
+
+---
+
+# 9. Security Testing
+
+Test for:
+
+* Authentication vulnerabilities
+* Authorization flaws
+* Input validation issues
+* SQL injection
+* Cross-site scripting (XSS)
+* CSRF attacks
+* Session management issues
+* Encryption implementation
+* API security
+* Access control
+
+---
+
+# 10. Accessibility Testing
+
+Verify:
+
+* WCAG compliance (A, AA, AAA)
+* Keyboard navigation
+* Screen reader compatibility
+* Color contrast ratios
+* Font sizing and readability
+* Form labeling
+* Alt text for images
+* Video captions
+* Assistive technology compatibility
+
+---
+
+# 11. Compatibility Testing
+
+Test across:
+
+* Operating systems (Windows, macOS, Linux)
+* Browsers (Chrome, Firefox, Safari, Edge)
+* Browser versions
+* Devices (desktop, tablet, mobile)
+* Screen resolutions
+* Network speeds
+* Installed plugins and extensions
+
+---
+
+# 12. Mobile Testing
+
+Test:
+
+* Touch interactions
+* Gestures
+* Screen orientations
+* Different screen sizes
+* Mobile OS versions
+* Network conditions
+* Battery impact
+* Memory constraints
+* Background behaviors
+
+---
+
+# 13. Test Data Management
+
+Manage:
+
+* Test data creation
+* Test data privacy
+* Test data versioning
+* Data reset between tests
+* Production data anonymization
+* Test data consistency
+* Test environment data
+* Sensitive data handling
+
+---
+
+# 14. Continuous Quality
+
+Implement:
+
+* Continuous testing in CI/CD
+* Automated test execution
+* Test result reporting
+* Quality gates
+* Metrics tracking
+* Trend analysis
+* Feedback loops
+* Regular improvement
+
+---
+
+# 15. Best Practices
+
+Always:
+
+* Define clear test objectives
+* Design tests based on requirements
+* Execute tests in controlled environments
+* Document test results thoroughly
+* Prioritize critical functionality
+* Use data-driven testing
+* Maintain test independence
+* Keep tests maintainable
+* Track metrics consistently
+* Iterate based on results
+
+Never:
+
+* Test in production
+* Skip regression testing
+* Ignore performance issues
+* Deploy untested code
+* Assume manual testing is unneeded
+* Skip accessibility testing
+* Test incomplete features
+* Ignore documented defects
+* Skip environment setup
+
+---
+
+# 16. Deliverables
+
+Every QA implementation should include:
+
+## Test Plans
+* Scope and objectives
+* Test strategy
+* Resource needs
+* Timeline
+
+## Test Cases
+* Preconditions
+* Steps
+* Expected results
+* Data requirements
+
+## Test Automation
+* Test scripts
+* Test data
+* Configuration
+* Documentation
+
+## Defect Reports
+* Description
+* Severity/Priority
+* Steps to reproduce
+* Evidence (screenshots, logs)
+
+## Metrics & Reports
+* Test execution status
+* Defect summary
+* Coverage metrics
+* Quality trends
+
+## Documentation
+* Test environment setup
+* Test data guide
+* Troubleshooting guide
+* Lessons learned
+
+---
+
+# Success Criteria
+
+A successful QA implementation should:
+
+* Identify defects before production
+* Achieve defined coverage targets
+* Provide reliable test results
+* Support rapid feedback
+* Reduce production defects
+* Enable confident deployments
+* Be maintainable and scalable
+* Track and improve metrics
+* Document findings clearly
+* Enable quality gates

package/skills/security/README.md

@@ -0,0 +1,108 @@
+# Security
+
+## Overview
+
+The **Security** skill enables AI models to design, implement, and maintain secure software systems by identifying vulnerabilities, enforcing best practices, conducting security testing, and ensuring compliance with security standards and regulations.
+
+This skill covers secure development, threat modeling, vulnerability assessment, incident response, and security operations.
+
+---
+
+# Goals
+
+* Identify and fix vulnerabilities
+* Implement security best practices
+* Conduct security testing
+* Ensure compliance
+* Respond to incidents
+* Reduce attack surface
+* Build security awareness
+* Maintain secure systems
+
+---
+
+# Capabilities
+
+## Threat Modeling
+* Risk assessment
+* Threat identification
+* Impact analysis
+* Mitigation planning
+
+## Vulnerability Management
+* Vulnerability scanning
+* Penetration testing
+* Code review for security
+* Compliance auditing
+
+## Secure Development
+* Secure coding practices
+* Authentication design
+* Authorization implementation
+* Encryption implementation
+
+## Incident Response
+* Incident detection
+* Containment
+* Investigation
+* Recovery
+* Post-incident analysis
+
+---
+
+# When to Use
+
+* Designing secure systems
+* Conducting security reviews
+* Testing for vulnerabilities
+* Responding to incidents
+* Improving security practices
+* Ensuring compliance
+* Threat modeling
+
+---
+
+# Expected Workflow
+
+```
+Identify Threats
+        ↓
+Assess Risks
+        ↓
+Design Mitigations
+        ↓
+Implement Controls
+        ↓
+Test & Verify
+        ↓
+Monitor & Maintain
+```
+
+---
+
+# Best Practices
+
+Always:
+* Follow secure development practices
+* Validate and sanitize inputs
+* Use strong authentication
+* Encrypt sensitive data
+* Keep dependencies updated
+* Conduct security reviews
+* Monitor for threats
+* Respond to incidents quickly
+
+Never:
+* Hardcode credentials
+* Skip security testing
+* Use weak encryption
+* Trust user input
+* Ignore security warnings
+* Delay security patches
+* Skip compliance checks
+
+---
+
+# Success Criteria
+
+Successful security reduces vulnerabilities, maintains compliance, enables rapid incident response, and maintains user trust.

package/skills/security/examples.md

@@ -0,0 +1,85 @@
+# Security Skill - Examples
+
+This document contains practical examples demonstrating when and how to use the Security Skill.
+
+---
+
+# Example 1 - Security Code Review
+
+## User Request
+Review this authentication module for security issues.
+
+## Expected Behavior
+* Check for injection vulnerabilities
+* Verify input validation
+* Review cryptography usage
+* Check secret handling
+* Verify session management
+* Document findings
+* Recommend fixes
+
+---
+
+# Example 2 - Threat Modeling
+
+## User Request
+Conduct threat modeling for this new feature.
+
+## Expected Behavior
+* Identify potential threats
+* Assess impact
+* Design mitigations
+* Recommend controls
+* Create threat model diagram
+* Document assumptions
+
+---
+
+# Example 3 - Vulnerability Assessment
+
+## User Request
+Scan this application for vulnerabilities.
+
+## Expected Behavior
+* Run security scanners
+* Review dependencies
+* Check configurations
+* Analyze architecture
+* Document findings
+* Prioritize by severity
+
+---
+
+# Example 4 - Compliance Audit
+
+## User Request
+Audit compliance with security standards.
+
+## Expected Behavior
+* Map requirements
+* Check implementations
+* Document evidence
+* Identify gaps
+* Create remediation plan
+* Track progress
+
+---
+
+# Example 5 - Incident Response
+
+## User Request
+We may have a security incident. Help us respond.
+
+## Expected Behavior
+* Assess severity
+* Contain threat
+* Collect evidence
+* Investigate root cause
+* Implement fix
+* Document lessons learned
+
+---
+
+# Success Criteria
+
+Successful security engineering reduces vulnerabilities, maintains compliance, enables incident response, and maintains user trust.