code-ai-installer 1.5.5 → 2.0.1

package/domains/development/locales/en/.agents/skills/qa-regression-baseline/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-regression-baseline",
+  "display_name": "QA Regression Baseline Skill",
+  "description": ">",
+  "default_prompt": "Use $qa-regression-baseline when the task matches the \"QA Regression Baseline Skill\" skill.",
+  "triggers": [
+    "qa-regression-baseline",
+    "qa regression baseline",
+    "QA Regression Baseline Skill",
+    ">"
+  ],
+  "capabilities": [
+    "qa",
+    "regression",
+    "baseline"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-regression-baseline/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "QA Regression Baseline Skill"
+  short_description: ">"
+  default_prompt: "Use $qa-regression-baseline when the task matches the \"QA Regression Baseline Skill\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/domains/development/locales/en/.agents/skills/qa-regression-baseline/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-regression-baseline",
+  "display_name": "QA Regression Baseline Skill",
+  "description": ">",
+  "default_prompt": "Use $qa-regression-baseline when the task matches the \"QA Regression Baseline Skill\" skill.",
+  "triggers": [
+    "qa-regression-baseline",
+    "qa regression baseline",
+    "QA Regression Baseline Skill",
+    ">"
+  ],
+  "capabilities": [
+    "qa",
+    "regression",
+    "baseline"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-regression-baseline/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "qa-regression-baseline"
+display_name: "QA Regression Baseline Skill"
+description: ">"
+default_prompt: "Use $qa-regression-baseline when the task matches the \"QA Regression Baseline Skill\" skill."
+triggers:
+  - "qa-regression-baseline"
+  - "qa regression baseline"
+  - "QA Regression Baseline Skill"
+  - ">"
+capabilities:
+  - "qa"
+  - "regression"
+  - "baseline"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/SKILL.md

@@ -0,0 +1,188 @@
+---
+name: qa-security-smoke-tests
+description: Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.
+---
+
+# Skill: QA Security Smoke Tests
+
+Run security smoke: auth, validation, error exposure, rate limiting.
+
+**Sections:**
+1. [Workflow](#1-workflow)
+2. [Test Cases](#2-test-cases)
+3. [Curl Commands](#3-curl)
+4. [Log Inspection](#4-logs)
+5. [Output Template](#5-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Identify protected endpoints (from $api-contracts)
+2. For each protected endpoint:
+   a. Request without auth → expect 401
+   b. Request with someone else's auth → expect 403/404
+   c. Invalid input → expect 400 (not 500!)
+   d. Check error response: no stack/DB/PII
+3. For public endpoints:
+   a. Check rate limiting (if enabled)
+4. Check logs: no PII/secrets
+5. Fill results table
+```
+
+---
+
+## 2. Test Cases
+
+| TC-ID | Category | Test | Request | Expected | Priority |
+|-------|----------|------|---------|----------|:--------:|
+| SEC-TC-01 | **Auth** | No token on protected endpoint | POST /coupons (no Authorization) | 401 | P0 |
+| SEC-TC-02 | **Auth** | Invalid token | POST /coupons (garbage token) | 401 | P0 |
+| SEC-TC-03 | **Auth** | Expired token | POST /coupons (expired JWT) | 401 | P1 |
+| SEC-TC-04 | **IDOR** | Access other user's data | GET /settings/other-app-id | 403 or 404 | P0 |
+| SEC-TC-05 | **IDOR** | Modify other user's data | PUT /settings/other-app-id | 403 or 404 | P0 |
+| SEC-TC-06 | **IDOR** | Delete other user's data | DELETE /coupons/other-user-coupon | 403 or 404 | P0 |
+| SEC-TC-07 | **Validation** | Empty body | POST /coupons `{}` | 400 (not 500!) | P0 |
+| SEC-TC-08 | **Validation** | Malicious field types | POST /coupons `{"code": 12345}` | 400 | P0 |
+| SEC-TC-09 | **Validation** | Oversized input | POST /coupons `{"code": "A".repeat(10000)}` | 400 | P1 |
+| SEC-TC-10 | **NoSQL** | Operator injection | GET /coupons?code[$gt]= | 400 (not data leak!) | P0 |
+| SEC-TC-11 | **Error leak** | Trigger 500 | Cause server error | No stack/DB in response | P0 |
+| SEC-TC-12 | **Error leak** | Check error format | Any 4xx/5xx | `{ error: { code, message } }` only | P0 |
+| SEC-TC-13 | **Rate limit** | Flood endpoint | 100+ requests/min | 429 (if enabled) | P1 |
+| SEC-TC-14 | **Headers** | Check security headers | Any response | X-Content-Type-Options, etc. | P1 |
+| SEC-TC-15 | **XSS** | Script in input | POST /settings `{"title": "<script>alert(1)</script>"}` | Stored sanitized or rejected | P0 |
+
+---
+
+## 3. Curl Commands
+
+### No auth (SEC-TC-01)
+
+```bash
+curl -s -o /dev/null -w "%{http_code}" \
+  -X POST https://localhost:5173/api/v1/coupons \
+  -H "Content-Type: application/json" \
+  -d '{"code":"TEST","discount":10}'
+# Expected: 401
+```
+
+### IDOR check (SEC-TC-04)
+
+```bash
+curl -s -w "\n%{http_code}" \
+  -X GET https://localhost:5173/api/v1/settings/OTHER_APP_INSTANCE_ID \
+  -H "Authorization: Bearer <my_token>"
+# Expected: 403 or 404 (NOT 200 with other user's data!)
+```
+
+### NoSQL injection (SEC-TC-10)
+
+```bash
+curl -s -w "\n%{http_code}" \
+  "https://localhost:5173/api/v1/coupons?code[\$gt]="
+# Expected: 400 (NOT 200 with all coupons!)
+```
+
+### Error exposure check (SEC-TC-11)
+
+```bash
+curl -s -X POST https://localhost:5173/api/v1/coupons \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer <token>" \
+  -d '{"code": null}' | python3 -m json.tool
+# Check: no "stack", no "MongoError", no file paths in response
+```
+
+### XSS in input (SEC-TC-15)
+
+```bash
+curl -s -X PUT https://localhost:5173/api/v1/settings/MY_ID \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer <token>" \
+  -d '{"title": "<script>alert(1)</script>"}'
+# Check: title should be sanitized/escaped, NOT stored as raw HTML
+```
+
+### Security headers (SEC-TC-14)
+
+```bash
+curl -sI https://localhost:5173/api/v1/health/live | grep -iE "x-content-type|x-frame|strict-transport|referrer-policy"
+# Expected: security headers present
+```
+
+---
+
+## 4. Log Inspection
+
+### After running tests, check logs for PII/secrets
+
+```bash
+# Check application logs (Docker)
+docker compose logs api --tail 100 | grep -iE "password|token|secret|apiKey|authorization"
+# Expected: ZERO matches (all should be [REDACTED])
+
+# Check for stack traces in response bodies
+docker compose logs api --tail 100 | grep -i "stack"
+# Expected: internal logs only, never in HTTP responses
+
+# Check for PII
+docker compose logs api --tail 100 | grep -iE "email.*@|phone.*\d{7}"
+# Expected: masked or absent
+```
+
+---
+
+## 5. Output Template
+
+```markdown
+# Security Smoke Test Report
+
+**Date:** YYYY-MM-DD
+**Tester:** Tester Agent
+**Environment:** <URL>
+
+## Results
+
+| TC-ID | Category | Test | Expected | Actual | Status |
+|-------|----------|------|:--------:|:------:|:------:|
+| SEC-TC-01 | Auth | No token | 401 | 401 | ✅ |
+| SEC-TC-04 | IDOR | Other user's data | 403/404 | 200 😱 | ❌ |
+| SEC-TC-07 | Validation | Empty body | 400 | 500 | ❌ |
+| SEC-TC-10 | NoSQL | Operator injection | 400 | 200 | ❌ |
+| SEC-TC-11 | Error leak | Trigger 500 | No stack | Has stack | ❌ |
+| SEC-TC-14 | Headers | Security headers | Present | Missing | ⚠️ |
+
+## Log Inspection
+| Check | Result |
+|-------|--------|
+| Secrets in logs | ✅ Clean |
+| Stack traces in logs | ✅ Internal only |
+| PII in logs | ⚠️ Email unmasked |
+
+## Summary
+| Status | Count |
+|--------|:-----:|
+| ✅ PASS | X |
+| ❌ FAIL | Y |
+| ⚠️ WARN | Z |
+
+## Critical Findings
+| # | Severity | Finding | Impact | Fix |
+|---|----------|---------|--------|-----|
+| 1 | 🔴 P0 | IDOR: other user's settings accessible | Data breach | Add ownership check |
+| 2 | 🔴 P0 | NoSQL injection: $gt operator not filtered | Data leak | Add input sanitization |
+
+## Verdict
+- ✅ SECURE — all security smoke tests pass
+- ⚠️ ISSUES — P1 findings to address
+- ❌ VULNERABLE — P0 security findings, block release
+```
+
+---
+
+## See also
+- `$security-review` — deep AppSec review (code level)
+- `$security-review-baseline` — quick security checklist
+- `$qa-api-contract-tests` — functional API tests
+- `$qa-test-plan` — test plan (references this skill)

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-security-smoke-tests",
+  "display_name": "QA Security Smoke Tests",
+  "description": "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.",
+  "default_prompt": "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill.",
+  "triggers": [
+    "qa-security-smoke-tests",
+    "qa security smoke tests",
+    "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant"
+  ],
+  "capabilities": [
+    "qa",
+    "security",
+    "smoke",
+    "tests"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-security-smoke-tests",
+  "display_name": "QA Security Smoke Tests",
+  "description": "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.",
+  "default_prompt": "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill.",
+  "triggers": [
+    "qa-security-smoke-tests",
+    "qa security smoke tests",
+    "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant"
+  ],
+  "capabilities": [
+    "qa",
+    "security",
+    "smoke",
+    "tests"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-security-smoke-tests",
+  "display_name": "QA Security Smoke Tests",
+  "description": "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.",
+  "default_prompt": "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill.",
+  "triggers": [
+    "qa-security-smoke-tests",
+    "qa security smoke tests",
+    "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant"
+  ],
+  "capabilities": [
+    "qa",
+    "security",
+    "smoke",
+    "tests"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "QA Security Smoke Tests"
+  short_description: "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if en…"
+  default_prompt: "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "qa-security-smoke-tests",
+  "display_name": "QA Security Smoke Tests",
+  "description": "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant.",
+  "default_prompt": "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill.",
+  "triggers": [
+    "qa-security-smoke-tests",
+    "qa security smoke tests",
+    "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant"
+  ],
+  "capabilities": [
+    "qa",
+    "security",
+    "smoke",
+    "tests"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-security-smoke-tests/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "qa-security-smoke-tests"
+display_name: "QA Security Smoke Tests"
+description: "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant."
+default_prompt: "Use $qa-security-smoke-tests when the task matches the \"QA Security Smoke Tests\" skill."
+triggers:
+  - "qa-security-smoke-tests"
+  - "qa security smoke tests"
+  - "Basic security smoke tests — auth/authz, validation, leaks in errors/logs, rate limiting (if enabled), SSRF/XSS where relevant"
+capabilities:
+  - "qa"
+  - "security"
+  - "smoke"
+  - "tests"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "en"
+  available_locales:
+    - "ru"
+    - "en"

package/domains/development/locales/en/.agents/skills/qa-test-plan/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: qa-test-plan
+description: Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria.
+---
+
+# Skill: QA Test Plan
+
+Test plan with coverage matrix based on PRD/UX flows.
+
+**Sections:**
+1. [Workflow](#1-workflow)
+2. [Test Plan Structure](#2-structure)
+3. [Coverage Matrix](#3-matrix)
+4. [Risk-Based Prioritization](#4-priority)
+5. [Entry/Exit Criteria](#5-criteria)
+6. [Example](#6-example)
+7. [Output Template](#7-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Read PRD / UX Spec / Architecture Doc
+   └── Extract user flows and acceptance criteria
+
+2. Determine scope:
+   ├── What we test (in scope)
+   └── What we DO NOT test (out of scope + why)
+
+3. Break down into test suites by categories:
+   ├── Functional (happy + edge + error paths)
+   ├── API contracts
+   ├── Security smoke
+   ├── UI/a11y smoke
+   └── Performance baseline
+
+4. For each flow → test cases (section 3)
+
+5. Prioritization (section 4)
+
+6. Determine entry/exit criteria (section 5)
+```
+
+---
+
+## 2. Test Plan Structure
+
+| Section | Content |
+|---------|---------|
+| **Scope** | What's included, what's excluded (with rationale) |
+| **Assumptions** | Prerequisites, test environment conditions |
+| **Test suites** | Groups of test cases by feature/area |
+| **Coverage matrix** | Flow → test cases mapping |
+| **Test data** | Required data setup / seed / fixtures |
+| **Environment** | URLs, credentials, infra requirements |
+| **Blockers/Risks** | What could prevent testing |
+| **Schedule** | When each suite runs (CI / manual / release) |
+
+---
+
+## 3. Coverage Matrix
+
+### Test case format
+
+| Field | Description | Example |
+|-------|-------------|---------|
+| **TC-ID** | Unique ID | TC-COUPON-01 |
+| **Flow** | User flow being tested | Create coupon |
+| **Type** | happy / edge / error / security | happy |
+| **Preconditions** | Required state | User logged in, app installed |
+| **Steps** | Numbered actions | 1. Open settings 2. Fill form 3. Click Save |
+| **Expected Result** | What should happen | Coupon saved, toast shown |
+| **Priority** | P0 / P1 / P2 | P0 |
+| **Automation** | Unit / Integration / E2E / Manual | Integration |
+
+### Coverage matrix example
+
+| Flow | Happy | Edge | Error | Security | Total |
+|------|:-----:|:----:|:-----:|:--------:|:-----:|
+| Install webhook | TC-01 | TC-02 | TC-03, TC-04 | TC-05 | 5 |
+| Settings CRUD | TC-06 | TC-07, TC-08 | TC-09, TC-10 | TC-11 | 6 |
+| Coupon create | TC-12 | TC-13, TC-14 | TC-15, TC-16, TC-17 | TC-18 | 7 |
+| Widget render | TC-19 | TC-20 | TC-21 | TC-22 | 4 |
+| **Total** | 4 | 6 | 7 | 4 | **22** |
+
+---
+
+## 4. Risk-Based Prioritization
+
+| Priority | Criteria | Example |
+|----------|---------|---------|
+| 🔴 **P0** | Core functionality, data loss, security | Auth flow, payment, CRUD on main entities |
+| 🟠 **P1** | Important but recoverable, edge cases | Duplicate handling, pagination, error states |
+| 🟡 **P2** | Nice-to-have, cosmetic, rare paths | Tooltip text, animation timing, unusual screen sizes |
+
+### Priority distribution guideline
+
+| Priority | % of total test cases |
+|----------|:-----:|
+| P0 | 40-50% |
+| P1 | 30-40% |
+| P2 | 10-20% |
+
+---
+
+## 5. Entry/Exit Criteria
+
+### Entry criteria (start testing when)
+
+| # | Criterion | Status |
+|---|----------|--------|
+| 1 | Build successful | ☐ |
+| 2 | CI lint + unit tests pass | ☐ |
+| 3 | Environment accessible (dev/staging) | ☐ |
+| 4 | Test data seeded | ☐ |
+| 5 | All P0 dev tasks completed | ☐ |
+
+### Exit criteria (release when)
+
+| # | Criterion | Status |
+|---|----------|--------|
+| 1 | All P0 test cases PASS | ☐ |
+| 2 | All P1 test cases PASS (or waiver) | ☐ |
+| 3 | No open P0 bugs | ☐ |
+| 4 | Security smoke PASS | ☐ |
+| 5 | API contract compliance PASS | ☐ |
+
+---
+
+## 6. Example
+
+```markdown
+# Test Plan: SaaS Admin Panel — v1
+
+## Scope
+- IN: Settings CRUD, Product CRUD, Public content rendering
+- OUT: Analytics, multi-language (not in MVP)
+
+## Test Suites
+1. API Contract Tests (8 cases) → $qa-api-contract-tests
+2. Manual Functional (12 cases) → $qa-manual-run
+3. Security Smoke (6 cases) → $qa-security-smoke-tests
+4. UI/a11y Smoke (4 cases) → $qa-ui-a11y-smoke
+
+## Coverage: 30 test cases (P0: 12, P1: 13, P2: 5)
+## Entry: CI green, staging up, test data seeded
+## Exit: All P0 pass, no open P0 bugs
+```
+
+---
+
+## 7. Output Template
+
+```markdown
+# QA Test Plan: <feature/sprint>
+
+**Date:** YYYY-MM-DD
+**PRD:** <reference>
+**UX Spec:** <reference>
+
+## Scope
+- **In scope:** <list>
+- **Out of scope:** <list + rationale>
+
+## Assumptions
+- <list>
+
+## Test Suites
+| Suite | Cases | Priority mix | Method |
+|-------|:-----:|-------------|--------|
+| Functional | 15 | 6×P0, 6×P1, 3×P2 | Manual + Unit |
+| API Contract | 8 | 4×P0, 4×P1 | Integration |
+| Security Smoke | 6 | 4×P0, 2×P1 | Manual + Grep |
+| UI/a11y | 4 | 1×P0, 2×P1, 1×P2 | Manual |
+
+## Coverage Matrix
+<section 3 table>
+
+## Test Data
+- <required fixtures/seed data>
+
+## Environment
+- URL: <staging URL>
+- Credentials: <how to get>
+
+## Entry/Exit Criteria
+<section 5 tables>
+
+## Risks & Blockers
+| Risk | Impact | Mitigation |
+|------|--------|-----------|
+| Wix API down | P0: Install flow blocked | Skip, retest later |
+```
+
+---
+
+## See also
+- `$qa-manual-run` — execute manual test cases
+- `$qa-api-contract-tests` — API contract test execution
+- `$qa-security-smoke-tests` — security smoke execution
+- `$qa-ui-a11y-smoke` — UI/a11y smoke execution
+- `$qa-browser-testing` — browser-based visual testing

package/domains/development/locales/en/.agents/skills/qa-test-plan/agents/claude.json

@@ -0,0 +1,18 @@
+{
+  "name": "qa-test-plan",
+  "display_name": "QA Test Plan",
+  "description": "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria.",
+  "default_prompt": "Use $qa-test-plan when the task matches the \"QA Test Plan\" skill.",
+  "triggers": [
+    "qa-test-plan",
+    "qa test plan",
+    "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria"
+  ],
+  "capabilities": [
+    "qa",
+    "test",
+    "plan"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-test-plan/agents/copilot.json

@@ -0,0 +1,18 @@
+{
+  "name": "qa-test-plan",
+  "display_name": "QA Test Plan",
+  "description": "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria.",
+  "default_prompt": "Use $qa-test-plan when the task matches the \"QA Test Plan\" skill.",
+  "triggers": [
+    "qa-test-plan",
+    "qa test plan",
+    "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria"
+  ],
+  "capabilities": [
+    "qa",
+    "test",
+    "plan"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-test-plan/agents/gemini.json

@@ -0,0 +1,18 @@
+{
+  "name": "qa-test-plan",
+  "display_name": "QA Test Plan",
+  "description": "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria.",
+  "default_prompt": "Use $qa-test-plan when the task matches the \"QA Test Plan\" skill.",
+  "triggers": [
+    "qa-test-plan",
+    "qa test plan",
+    "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria"
+  ],
+  "capabilities": [
+    "qa",
+    "test",
+    "plan"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/qa-test-plan/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "QA Test Plan"
+  short_description: "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states,…"
+  default_prompt: "Use $qa-test-plan when the task matches the \"QA Test Plan\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/domains/development/locales/en/.agents/skills/qa-test-plan/agents/qwen.json

@@ -0,0 +1,18 @@
+{
+  "name": "qa-test-plan",
+  "display_name": "QA Test Plan",
+  "description": "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria.",
+  "default_prompt": "Use $qa-test-plan when the task matches the \"QA Test Plan\" skill.",
+  "triggers": [
+    "qa-test-plan",
+    "qa test plan",
+    "Create a test plan and coverage matrix based on PRD/UX — roles, critical user flows, UI states, negative cases, acceptance criteria"
+  ],
+  "capabilities": [
+    "qa",
+    "test",
+    "plan"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}