--- title: "QA Advisor" canonical: https://wavect.io/skills/qa-advisor/ language: en description: "Free AI skill that audits your tests like a senior engineer: test quality, OWASP security, reliability, DORA. Run it in Claude Code or any agent." image: "https://wavect.io/img/general/bak/open_graph_preview.jpg" --- Engineering ยท Free AI skill # QA Advisor Audit your tests like a senior engineer would. A senior QA engineer that grades the real quality of your tests and surfaces the security and reliability risks a green CI pipeline hides, with file-level evidence and the exact tests that should exist. [Run in Claude โ†’](https://claude.ai/new?q=Please+fetch+and+follow+this+Wavect+skill+carefully%3A+https%3A%2F%2Fwavect.io%2F.well-known%2Fagent-skills%2Fqa-advisor%2FSKILL.md) [Read the SKILL.md](https://wavect.io/.well-known/agent-skills/qa-advisor/SKILL.md) [Book a free call](/contact/) `https://wavect.io/.well-known/agent-skills/qa-advisor/SKILL.md` ๐Ÿ“‹ ## What it does QA Advisor audits a codebase across five dimensions: test quality, maintainability, security, reliability, and delivery health. It catches mocked-database tests that verify nothing, assertion theater, OWASP vulnerabilities, and skipped tests dressed up as in progress, then produces a severity-graded QA Audit Report. ## When to use it - Before a significant refactor, release, or infrastructure migration - Onboarding to an unfamiliar codebase to learn its real health - A bug escaped every existing test and you need systemic analysis - An investor, acquirer or new CTO requests technical due diligence - DORA metrics are poor and the team cannot explain why - Auditing a vibe-coded or AI-generated prototype before its first real users ## How it works 1. **Map before critiquing** - It fingerprints the test strategy, the test-to-source ratio, CI gates, and the highest-churn files that carry the most risk. 2. **Grade test quality** - It evaluates test doubles, assertion strength, and property-based and contract coverage, then flags coverage theater with evidence. 3. **Probe security and reliability** - It checks OWASP code-level patterns, database and migration testing, chaos and load behavior, and where the system breaks under failure. 4. **Score delivery and report** - It assesses DORA metrics and architecture testability, then leads with critical, ship-blocking findings at file and line level. ## What you get - Critical / High / Medium findings with file:line - Security Posture (OWASP), DORA assessment - Three-month remediation roadmap ## Frameworks it applies - Test double taxonomy - OWASP Top 10 - Property-based testing - Contract testing (Pact) - DORA metrics - Hexagonal architecture Wavect's Software QA engagement typically surfaces 40 to 70% more issues than internal teams in the first 30 days. This skill is the same lens. ## Go deeper - [Test quality](https://wavect.io/.well-known/agent-skills/qa-advisor/reference/test-quality.md) - [Security (OWASP)](https://wavect.io/.well-known/agent-skills/qa-advisor/reference/security.md) - [Reliability and scale](https://wavect.io/.well-known/agent-skills/qa-advisor/reference/reliability-and-scale.md) - [Architecture and maintainability](https://wavect.io/.well-known/agent-skills/qa-advisor/reference/architecture-and-maintainability.md) - [Delivery health (DORA)](https://wavect.io/.well-known/agent-skills/qa-advisor/reference/delivery-health.md) ## Questions about QA Advisor ### Is QA Advisor free? Yes. Open source under MIT and free to run in Claude Code, Cursor, or any AI agent with access to your repository. No API key or signup. ### What does the report contain? Critical, High and Medium findings with file and line references, a test-quality scorecard, security posture against OWASP, a DORA assessment, and a three-month remediation roadmap. ### Does a high coverage number mean my tests are good? Not on its own. The skill is built to expose high coverage with happy-path-only assertions, which creates dangerous false confidence. It grades whether tests would actually catch real bugs. ### Will it just nitpick style? No. It ignores lint and style preferences and focuses on real risk: security holes, tests that verify nothing, and architecture that makes the system hard to change safely. ### Can QA Advisor audit AI-generated or vibe-coded code? Yes. It targets the production-readiness failure modes that AI-generated builds ship with: missing authorization, absent input validation, leaked secrets, and no regression net. See [QA for AI-generated code](/blog/qa-for-ai-generated-code/), [the vibe-coded software audit](/blog/vibe-coded-software-audit/), and [what vibe-coded software is](/glossary/vibe-coded-software/). ## More free Wavect skills [Product PMF Advisor Stop guessing if you have product-market fit.](/skills/pmf-advisor/) [GTM ICP Discovery Force specificity. Name the customer, the trigger, the pain.](/skills/icp-discovery/) [Pricing Pricing Strategy Kill cost-plus. Find the value metric. Charge what it's worth.](/skills/pricing-strategy/) [Conversion Website ICP-Fit Find out why the right visitor isn't converting.](/skills/website-icp-fit/) [High-Ticket High-Ticket Conversion Architect Design landing pages that close $10k+ offers.](/skills/high-ticket-conversion-architect/) [See all six skills and how to install them โ†’](/skills/) ## Want this done with you, not just by you? The skills are the tools. We've been using them on real client work since 2018. Fractional co-founder, full-stack delivery, QA leadership. If you'd rather have a human in the trenches with you, book a free call. [Get in touch โ†’](/contact/) ## Structured Data ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ], "employee": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "founder": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "legalRepresentative": [ { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } } ], "name": "Wavect GmbH", "subjectOf": { "@id": "https://wavect.io/verified-claims.json#dataset", "@type": "Dataset", "name": "Wavect verified publication claims", "url": "https://wavect.io/verified-claims.json" }, "url": "https://wavect.io/" }, { "@id": "https://wavect.io/team/kevin-riedl/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Kevin Riedl", "sameAs": [ "https://www.wikidata.org/wiki/Q139796365", "https://www.linkedin.com/in/wsdt", "https://github.com/wsdt" ], "url": "https://wavect.io/team/kevin-riedl/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/team/christof-jori/#person", "@type": "Person", "jobTitle": "Managing Director", "name": "Christof Jori", "sameAs": [ "https://www.wikidata.org/wiki/Q139796367", "https://www.linkedin.com/in/jocr77/", "https://github.com/jo-chris" ], "url": "https://wavect.io/team/christof-jori/", "worksFor": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] } }, { "@id": "https://wavect.io/#website", "@type": "WebSite", "inLanguage": [ "en", "de", "es", "zh" ], "name": "Wavect", "potentialAction": { "@type": "SearchAction", "query-input": "required name=search_term_string", "target": { "@type": "EntryPoint", "urlTemplate": "https://wavect.io/search/?q={search_term_string}" } }, "publisher": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/" } ] } ``` ```json { "@context": "https://schema.org", "@graph": [ { "@id": "https://wavect.io/skills/qa-advisor/#skill", "@type": "SoftwareApplication", "applicationCategory": "DeveloperApplication", "author": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "description": "Free AI skill that audits your tests like a senior engineer: test quality, OWASP security, reliability, DORA. Run it in Claude Code or any agent.", "installUrl": "https://wavect.io/.well-known/agent-skills/qa-advisor/SKILL.md", "isAccessibleForFree": true, "keywords": "Test double taxonomy, OWASP Top 10, Property-based testing, Contract testing (Pact), DORA metrics, Hexagonal architecture", "name": "QA Advisor", "offers": { "@type": "Offer", "availability": "https://schema.org/InStock", "price": "0", "priceCurrency": "EUR" }, "operatingSystem": "Any (AI agent, Claude, Cursor, Claude Code, MCP client)", "provider": { "@id": "https://wavect.io/#organization", "@type": [ "Organization", "ProfessionalService", "LocalBusiness" ] }, "url": "https://wavect.io/skills/qa-advisor/" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "item": "https://wavect.io/", "name": "Home", "position": 1 }, { "@type": "ListItem", "item": "https://wavect.io/skills/", "name": "AI Skills", "position": 2 }, { "@type": "ListItem", "item": "https://wavect.io/skills/qa-advisor/", "name": "QA Advisor", "position": 3 } ] }, { "@type": "HowTo", "description": "Free AI skill that audits your tests like a senior engineer: test quality, OWASP security, reliability, DORA. Run it in Claude Code or any agent.", "name": "How to use QA Advisor", "step": [ { "@type": "HowToStep", "name": "Map before critiquing", "position": 1, "text": "It fingerprints the test strategy, the test-to-source ratio, CI gates, and the highest-churn files that carry the most risk." }, { "@type": "HowToStep", "name": "Grade test quality", "position": 2, "text": "It evaluates test doubles, assertion strength, and property-based and contract coverage, then flags coverage theater with evidence." }, { "@type": "HowToStep", "name": "Probe security and reliability", "position": 3, "text": "It checks OWASP code-level patterns, database and migration testing, chaos and load behavior, and where the system breaks under failure." }, { "@type": "HowToStep", "name": "Score delivery and report", "position": 4, "text": "It assesses DORA metrics and architecture testability, then leads with critical, ship-blocking findings at file and line level." } ] }, { "@id": "https://wavect.io/skills/qa-advisor/#webpage", "@type": "WebPage", "description": "Free AI skill that audits your tests like a senior engineer: test quality, OWASP security, reliability, DORA. Run it in Claude Code or any agent.", "inLanguage": "en", "isPartOf": { "@id": "https://wavect.io/#website", "@type": "WebSite" }, "mainEntity": { "@id": "https://wavect.io/skills/qa-advisor/#skill" }, "name": "QA Advisor", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ ".skill-detail-hero__title", ".skill-detail-hero__lead", ".skill-detail-faq .faq-question", ".skill-detail-faq .faq-answer" ] }, "url": "https://wavect.io/skills/qa-advisor/" } ] } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Open source under MIT and free to run in Claude Code, Cursor, or any AI agent with access to your repository. No API key or signup." }, "name": "Is QA Advisor free?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Critical, High and Medium findings with file and line references, a test-quality scorecard, security posture against OWASP, a DORA assessment, and a three-month remediation roadmap." }, "name": "What does the report contain?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Not on its own. The skill is built to expose high coverage with happy-path-only assertions, which creates dangerous false confidence. It grades whether tests would actually catch real bugs." }, "name": "Does a high coverage number mean my tests are good?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "No. It ignores lint and style preferences and focuses on real risk: security holes, tests that verify nothing, and architecture that makes the system hard to change safely." }, "name": "Will it just nitpick style?" }, { "@type": "Question", "acceptedAnswer": { "@type": "Answer", "text": "Yes. It targets the production-readiness failure modes that AI-generated builds ship with: missing authorization, absent input validation, leaked secrets, and no regression net. See QA for AI-generated code, the vibe-coded software audit, and what vibe-coded software is." }, "name": "Can QA Advisor audit AI-generated or vibe-coded code?" } ], "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ ".faq-question", ".faq-answer" ] } } ```