aigroup-workflow 2.1.2 → 2.2.0

package/skills/quality/security-reviewer/references/vulnerability-patterns.md

@@ -0,0 +1,152 @@
+# Vulnerability Patterns
+
+## SQL Injection
+
+```typescript
+// VULNERABLE
+const query = `SELECT * FROM users WHERE id = ${userId}`;
+const query = `SELECT * FROM users WHERE name = '${name}'`;
+
+// SECURE - Parameterized queries
+const query = 'SELECT * FROM users WHERE id = $1';
+db.query(query, [userId]);
+
+// SECURE - ORM
+const user = await User.findOne({ where: { id: userId } });
+```
+
+## XSS (Cross-Site Scripting)
+
+```typescript
+// VULNERABLE - Direct HTML injection
+element.innerHTML = userInput;
+document.write(userInput);
+
+// SECURE - Text content
+element.textContent = userInput;
+
+// SECURE - Sanitization
+import DOMPurify from 'dompurify';
+element.innerHTML = DOMPurify.sanitize(userInput);
+
+// SECURE - React (auto-escaped)
+return <div>{userInput}</div>;
+
+// VULNERABLE - React dangerouslySetInnerHTML
+return <div dangerouslySetInnerHTML={{ __html: userInput }} />;
+```
+
+## Path Traversal
+
+```typescript
+// VULNERABLE
+const file = path.join(uploadDir, req.query.filename);
+res.sendFile(file);
+
+// SECURE - Validate and normalize
+const filename = path.basename(req.query.filename);
+const file = path.resolve(uploadDir, filename);
+
+if (!file.startsWith(path.resolve(uploadDir))) {
+  throw new Error('Invalid path');
+}
+res.sendFile(file);
+```
+
+## Command Injection
+
+```typescript
+// VULNERABLE
+exec(`ls ${userInput}`);
+exec('git clone ' + repoUrl);
+
+// SECURE - Use arrays, avoid shell
+execFile('ls', [userInput]);
+spawn('git', ['clone', repoUrl]);
+
+// SECURE - Validation
+const allowedCommands = ['status', 'log'];
+if (!allowedCommands.includes(cmd)) throw new Error('Invalid');
+```
+
+## IDOR (Insecure Direct Object Reference)
+
+```typescript
+// VULNERABLE - No authorization check
+app.get('/documents/:id', async (req, res) => {
+  const doc = await Document.findById(req.params.id);
+  res.json(doc);
+});
+
+// SECURE - Verify ownership
+app.get('/documents/:id', async (req, res) => {
+  const doc = await Document.findOne({
+    _id: req.params.id,
+    userId: req.user.id  // Ensure user owns document
+  });
+  if (!doc) return res.status(404).json({ error: 'Not found' });
+  res.json(doc);
+});
+```
+
+## Insecure Deserialization
+
+```typescript
+// VULNERABLE - Python pickle
+import pickle
+data = pickle.loads(user_input)
+
+// SECURE - Use JSON
+import json
+data = json.loads(user_input)
+
+// VULNERABLE - Node.js
+const obj = eval('(' + userInput + ')');
+
+// SECURE
+const obj = JSON.parse(userInput);
+```
+
+## Sensitive Data Exposure
+
+```typescript
+// VULNERABLE - Logging sensitive data
+logger.info('User login', { email, password });
+console.log('Token:', authToken);
+
+// SECURE - Redact sensitive fields
+logger.info('User login', { email, password: '[REDACTED]' });
+
+// VULNERABLE - Error response exposes internals
+res.status(500).json({ error: err.stack });
+
+// SECURE - Generic error
+res.status(500).json({ error: 'Internal server error' });
+```
+
+## Quick Reference
+
+| Vulnerability | Input Vector | Prevention |
+|---------------|--------------|------------|
+| SQL Injection | Query params | Parameterized queries |
+| XSS | User content | Output encoding |
+| Path Traversal | File paths | path.basename + validation |
+| Command Injection | Shell args | execFile, no shell |
+| IDOR | Resource IDs | Authorization checks |
+| Deserialization | Serialized data | JSON only |
+| Data Exposure | Logs, errors | Redaction, generic errors |
+
+## OWASP Top 10 Mapping
+
+| OWASP | Vulnerabilities |
+|-------|-----------------|
+| A01 Broken Access Control | IDOR, path traversal |
+| A02 Cryptographic Failures | Weak encryption, plaintext |
+| A03 Injection | SQL, XSS, command |
+| A04 Insecure Design | Missing auth, IDOR |
+| A05 Security Misconfiguration | Debug mode, default creds |
+| A06 Vulnerable Components | Outdated dependencies |
+| A07 Auth Failures | Weak passwords, session issues |
+| A08 Data Integrity | Insecure deserialization |
+| A09 Logging Failures | Missing logs, exposed data |
+| A10 SSRF | Unvalidated URLs |

package/skills/quality/test-master/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: test-master
+description: Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation, quality gates, shift-left testing, or test maintenance.
+license: MIT
+metadata:
+  author: https://github.com/Jeffallan
+  version: "1.1.1"
+  domain: quality
+  triggers: test, testing, QA, unit test, integration test, E2E, coverage, performance test, security test, regression, test strategy, test automation, test framework, quality metrics, defect, exploratory, usability, accessibility, localization, manual testing, shift-left, quality gate, flaky test, test maintenance
+  role: specialist
+  scope: testing
+  output-format: report
+  related-skills: fullstack-guardian, playwright-expert, devops-engineer, debugging-wizard, code-reviewer, feature-forge
+---
+
+# Test Master
+
+Comprehensive testing specialist ensuring software quality through functional, performance, and security testing.
+
+## Core Workflow
+
+1. **Define scope** — Identify what to test and which testing types apply
+2. **Create strategy** — Plan the test approach across functional, performance, and security perspectives
+3. **Write tests** — Implement tests with proper assertions (see example below)
+4. **Execute** — Run tests and collect results
+   - If tests fail: classify the failure (assertion error vs. environment/flakiness), fix root cause, re-run
+   - If tests are flaky: isolate ordering dependencies, check async handling, add retry or stabilization logic
+5. **Report** — Document findings with severity ratings and actionable fix recommendations
+   - Verify coverage targets are met before closing; flag gaps explicitly
+
+## Quick-Start Example
+
+A minimal Jest unit test illustrating the key patterns this skill enforces:
+
+```js
+// ✅ Good: meaningful description, specific assertion, isolated dependency
+describe('calculateDiscount', () => {
+  it('applies 10% discount for premium users', () => {
+    const result = calculateDiscount({ price: 100, userTier: 'premium' });
+    expect(result).toBe(90); // specific outcome, not just truthy
+  });
+
+  it('throws on negative price', () => {
+    expect(() => calculateDiscount({ price: -1, userTier: 'standard' }))
+      .toThrow('Price must be non-negative');
+  });
+});
+```
+
+Apply the same structure for pytest (`def test_…`, `assert result == expected`) and other frameworks.
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+<!-- TDD Iron Laws and Testing Anti-Patterns adapted from obra/superpowers by Jesse Vincent (@obra), MIT License -->
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Unit Testing | `references/unit-testing.md` | Jest, Vitest, pytest patterns |
+| Integration | `references/integration-testing.md` | API testing, Supertest |
+| E2E | `references/e2e-testing.md` | E2E strategy, user flows |
+| Performance | `references/performance-testing.md` | k6, load testing |
+| Security | `references/security-testing.md` | Security test checklist |
+| Reports | `references/test-reports.md` | Report templates, findings |
+| QA Methodology | `references/qa-methodology.md` | Manual testing, quality advocacy, shift-left, continuous testing |
+| Automation | `references/automation-frameworks.md` | Framework patterns, scaling, maintenance, team enablement |
+| TDD Iron Laws | `references/tdd-iron-laws.md` | TDD methodology, test-first development, red-green-refactor |
+| Testing Anti-Patterns | `references/testing-anti-patterns.md` | Test review, mock issues, test quality problems |
+
+## Constraints
+
+**MUST DO**
+- Test happy paths AND error/edge cases (e.g., empty input, null, boundary values)
+- Mock external dependencies — never call real APIs or databases in unit tests
+- Use meaningful `it('…')` descriptions that read as plain-English specifications
+- Assert specific outcomes (`expect(result).toBe(90)`), not just truthiness
+- Run tests in CI/CD; document and remediate coverage gaps
+
+**MUST NOT**
+- Skip error-path testing (e.g., don't test only the success branch of a try/catch)
+- Use production data in tests — use fixtures or factories instead
+- Create order-dependent tests — each test must be independently runnable
+- Ignore flaky tests — quarantine and fix them; don't just re-run until green
+- Test implementation details (internal method calls) — test observable behaviour
+
+## Output Templates
+
+When creating test plans, provide:
+1. Test scope and approach
+2. Test cases with expected outcomes
+3. Coverage analysis
+4. Findings with severity (Critical/High/Medium/Low)
+5. Specific fix recommendations

package/skills/quality/test-master/references/automation-frameworks.md

@@ -0,0 +1,294 @@
+# Automation Frameworks
+
+## Advanced Framework Patterns
+
+### Screenplay Pattern
+```typescript
+// Better separation of concerns than POM
+export class Actor {
+  constructor(private page: Page) {}
+  attemptsTo(...tasks: Task[]) {
+    return Promise.all(tasks.map(t => t.performAs(this)));
+  }
+}
+
+class Login implements Task {
+  constructor(private email: string, private password: string) {}
+  async performAs(actor: Actor) {
+    await actor.page.getByLabel('Email').fill(this.email);
+    await actor.page.getByLabel('Password').fill(this.password);
+    await actor.page.getByRole('button', { name: 'Login' }).click();
+  }
+}
+
+// Clear, maintainable test code
+await new Actor(page).attemptsTo(new Login('user@test.com', 'pass'));
+```
+
+### Keyword-Driven Testing
+```typescript
+const keywords = {
+  NAVIGATE: (page, url) => page.goto(url),
+  CLICK: (page, selector) => page.click(selector),
+  TYPE: (page, selector, text) => page.fill(selector, text),
+  VERIFY: (page, selector) => expect(page.locator(selector)).toBeVisible(),
+};
+
+// Data drives execution - ideal for non-technical authors
+const steps = [
+  { keyword: 'NAVIGATE', args: ['/login'] },
+  { keyword: 'TYPE', args: ['#email', 'user@test.com'] },
+  { keyword: 'CLICK', args: ['#submit'] },
+];
+
+for (const step of steps) await keywords[step.keyword](page, ...step.args);
+```
+
+### Model-Based Testing
+```typescript
+// State machine defines valid transitions
+const cartModel = {
+  empty: { addItem: 'hasItems' },
+  hasItems: { addItem: 'hasItems', removeItem: 'hasItems|empty', checkout: 'checkingOut' },
+  checkingOut: { confirm: 'complete', cancel: 'hasItems' },
+};
+
+// Generate comprehensive test paths automatically
+const testPaths = generatePathsFromModel(cartModel);
+```
+
+## Maintenance Strategies
+
+### Self-Healing Locators
+```typescript
+// Multi-strategy finder with automatic fallback
+async function findElement(page: Page, strategies: string[]): Promise<Locator> {
+  for (const selector of strategies) {
+    const el = page.locator(selector);
+    if (await el.count() > 0) return el;
+  }
+  throw new Error(`Not found: ${strategies.join(', ')}`);
+}
+
+// Usage: tries best -> good -> fallback
+const submit = await findElement(page, [
+  '[data-testid="submit"]',     // Best: stable test ID
+  'button:has-text("Submit")',  // Good: semantic
+  'button.primary',             // Fallback: CSS
+]);
+```
+
+### Error Recovery & Smart Retry
+```typescript
+// Auto-retry with recovery actions
+async function clickWithRecovery(page: Page, selector: string, retries = 3) {
+  for (let i = 0; i < retries; i++) {
+    try {
+      await page.click(selector, { timeout: 5000 });
+      return;
+    } catch (e) {
+      if (i === retries - 1) throw e;
+      await page.reload();
+      await page.waitForLoadState('networkidle');
+    }
+  }
+}
+
+// Exponential backoff for flaky operations
+async function retryWithBackoff<T>(fn: () => Promise<T>, retries = 3): Promise<T> {
+  for (let i = 0; i < retries; i++) {
+    try {
+      return await fn();
+    } catch (e) {
+      if (i === retries - 1) throw e;
+      await new Promise(r => setTimeout(r, 1000 * Math.pow(2, i)));
+    }
+  }
+}
+```
+
+## Scaling Strategies
+
+### Parallel & Distributed Execution
+```typescript
+// playwright.config.ts
+export default defineConfig({
+  workers: process.env.CI ? 8 : 4,
+  fullyParallel: true,
+  retries: process.env.CI ? 2 : 0,
+  
+  // Shard tests across multiple machines
+  shard: process.env.SHARD ? {
+    current: parseInt(process.env.SHARD_INDEX),
+    total: parseInt(process.env.SHARD_TOTAL),
+  } : undefined,
+});
+```
+
+```yaml
+# GitHub Actions: distribute across 5 workers
+strategy:
+  matrix:
+    shard: [1, 2, 3, 4, 5]
+steps:
+  - run: npx playwright test --shard=${{ matrix.shard }}/5
+```
+
+### Resource Optimization
+```typescript
+// Reuse browser contexts for faster execution
+let browser: Browser;
+let context: BrowserContext;
+
+test.beforeAll(async () => {
+  browser = await chromium.launch();
+  context = await browser.newContext();
+});
+
+test('test 1', async () => {
+  const page = await context.newPage();
+  // Test logic
+  await page.close();
+});
+
+test.afterAll(async () => {
+  await context.close();
+  await browser.close();
+});
+```
+
+## CI/CD Integration
+
+### Complete Pipeline
+```yaml
+name: E2E Tests
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        shard: [1, 2, 3, 4]
+    
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+      - run: npm ci
+      - run: npx playwright install --with-deps
+      
+      - run: npx playwright test --shard=${{ matrix.shard }}/4
+        env:
+          CI: true
+      
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: report-${{ matrix.shard }}
+          path: playwright-report/
+```
+
+### Test Data Factories
+```typescript
+export class UserFactory {
+  static create(overrides?: Partial<User>): User {
+    return {
+      id: faker.string.uuid(),
+      email: faker.internet.email(),
+      name: faker.person.fullName(),
+      role: 'user',
+      ...overrides,
+    };
+  }
+
+  static createMany(count: number) {
+    return Array.from({ length: count }, () => this.create());
+  }
+}
+
+// Seed test data
+test.beforeEach(async ({ page }) => {
+  await page.request.post('/api/test/seed', {
+    data: { users: UserFactory.createMany(10) },
+  });
+});
+```
+
+## Team Enablement
+
+### Training Program
+```markdown
+**Week 1-2**: Framework basics, page objects, first test
+**Week 3-4**: Data-driven, API integration, CI/CD
+**Week 5-6**: Performance, error handling, scaling
+**Ongoing**: Code reviews, knowledge sharing
+```
+
+### Code Review Checklist
+```markdown
+- [ ] Independent tests (no order dependency)
+- [ ] Semantic locators (getByRole, getByLabel)
+- [ ] Proper waits (no arbitrary timeouts)
+- [ ] Error cases tested
+- [ ] Test data cleanup
+- [ ] Meaningful test names
+- [ ] Page objects updated
+```
+
+## Automation Strategy
+
+### ROI Calculation
+```typescript
+const manual = { timePerRun: 30, runsPerSprint: 10 };
+const automation = { development: 120, maintenance: 5 };
+
+const timeSaved = (manual.timePerRun * manual.runsPerSprint) - automation.maintenance;
+const breakEven = Math.ceil(automation.development / timeSaved);
+const annualSavings = (timeSaved * 26 - automation.development) / 60; // hours
+
+// Example: Break-even in 1 sprint, save 110 hours/year
+```
+
+### Selection Criteria
+```markdown
+**Automate**: Repetitive, stable UI, critical paths, data-driven, positive ROI
+**Don't Automate**: Exploratory, changing UI, one-time, usability, negative ROI
+```
+
+## Reporting & Metrics
+
+### Custom Reporter
+```typescript
+class MetricsReporter implements Reporter {
+  onTestEnd(test: TestCase, result: TestResult) {
+    this.sendMetrics({
+      name: test.title,
+      duration: result.duration,
+      status: result.status,
+      retries: result.retry,
+    });
+  }
+}
+```
+
+## Quick Reference
+
+| Pattern | Best For | Complexity |
+|---------|----------|-----------|
+| Page Object | Reusable components | Medium |
+| Screenplay | Complex workflows | High |
+| Keyword-Driven | Non-tech testers | Low |
+| Model-Based | State machines | High |
+
+| Scaling | Use Case |
+|---------|----------|
+| Parallel | Reduce time |
+| Distributed | Large suites |
+| Cloud | Cross-browser |
+| Resource Reuse | Speed |
+
+| Tool | Category |
+|------|----------|
+| Playwright, Cypress | Web E2E |
+| Appium, Detox | Mobile |
+| k6, Gatling | Performance |

package/skills/quality/test-master/references/e2e-testing.md

@@ -0,0 +1,128 @@
+# E2E Testing
+
+## E2E Test Strategy
+
+```typescript
+// Critical user paths to test
+const criticalPaths = [
+  'User registration and login',
+  'Core product/service workflow',
+  'Payment/checkout flow',
+  'Settings and profile management',
+];
+```
+
+## User Flow Testing
+
+```typescript
+import { test, expect } from '@playwright/test';
+
+test.describe('User Registration Flow', () => {
+  test('complete registration', async ({ page }) => {
+    await page.goto('/register');
+
+    await page.getByLabel('Email').fill('new@example.com');
+    await page.getByLabel('Password').fill('SecurePass123!');
+    await page.getByLabel('Confirm Password').fill('SecurePass123!');
+    await page.getByRole('button', { name: 'Register' }).click();
+
+    await expect(page).toHaveURL(/dashboard/);
+    await expect(page.getByText('Welcome')).toBeVisible();
+  });
+
+  test('shows validation errors', async ({ page }) => {
+    await page.goto('/register');
+
+    await page.getByLabel('Email').fill('invalid');
+    await page.getByRole('button', { name: 'Register' }).click();
+
+    await expect(page.getByText('Invalid email')).toBeVisible();
+  });
+});
+```
+
+## Checkout Flow
+
+```typescript
+test.describe('Checkout Flow', () => {
+  test('complete purchase', async ({ page }) => {
+    // Add to cart
+    await page.goto('/products/123');
+    await page.getByRole('button', { name: 'Add to Cart' }).click();
+    await expect(page.getByTestId('cart-count')).toHaveText('1');
+
+    // Checkout
+    await page.goto('/cart');
+    await page.getByRole('button', { name: 'Checkout' }).click();
+
+    // Payment
+    await page.getByLabel('Card Number').fill('4242424242424242');
+    await page.getByLabel('Expiry').fill('12/25');
+    await page.getByLabel('CVC').fill('123');
+    await page.getByRole('button', { name: 'Pay' }).click();
+
+    // Confirmation
+    await expect(page).toHaveURL(/order-confirmation/);
+    await expect(page.getByText('Order Confirmed')).toBeVisible();
+  });
+});
+```
+
+## Test Data Management
+
+```typescript
+// fixtures/testData.ts
+export const testUsers = {
+  standard: {
+    email: 'standard@test.com',
+    password: 'TestPass123!',
+  },
+  admin: {
+    email: 'admin@test.com',
+    password: 'AdminPass123!',
+  },
+};
+
+// Test setup
+test.beforeEach(async ({ page }) => {
+  // Seed test data
+  await page.request.post('/api/test/seed');
+});
+
+test.afterEach(async ({ page }) => {
+  // Clean up
+  await page.request.post('/api/test/cleanup');
+});
+```
+
+## Cross-Browser Testing
+
+```typescript
+// playwright.config.ts
+export default defineConfig({
+  projects: [
+    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
+    { name: 'firefox', use: { ...devices['Desktop Firefox'] } },
+    { name: 'webkit', use: { ...devices['Desktop Safari'] } },
+    { name: 'mobile-chrome', use: { ...devices['Pixel 5'] } },
+    { name: 'mobile-safari', use: { ...devices['iPhone 13'] } },
+  ],
+});
+```
+
+## Quick Reference
+
+| Pattern | When to Use |
+|---------|-------------|
+| Happy path | Critical user journeys |
+| Error handling | Form validation, API errors |
+| Edge cases | Empty states, max limits |
+| Cross-browser | Before major releases |
+| Mobile | Responsive features |
+
+| Priority | Test Coverage |
+|----------|---------------|
+| **P0** | Registration, login, core feature |
+| **P1** | Payment, settings, common flows |
+| **P2** | Edge cases, admin features |
+| **P3** | Rare scenarios |