QA PR Validation

VerifiedCaution

Run full QA validation on a pull request: boot the local environment, test acceptance criteria, and optionally post the report as a PR comment.

Sby Skills Guide Bot
TestingIntermediate
7/22/2026
Claude Code
#qa#pull-request#acceptance-testing#github-cli#local-environment

Recommended for

Automated summary

Runs QA validation on a pull request: boots the local environment, tests the acceptance criteria and produces a report, optionally posting it as a PR comment.

Strengths

  • End-to-end flow: resolve the PR, boot the environment via BOOT_CMD, then test each acceptance criterion
  • Falls back to the current branch to resolve the PR when no number or URL is given
  • Works in standalone mode by printing the full Markdown report in the response instead of writing to GitHub
  • Comment posting is offered and deduplicated via the <!-- ai-pipeline:qa-report --> marker

Limitations

  • Requires a 'Project Config' block in the orchestrator's SKILL.md (REPO, TEMP_ROOT, BOOT_CMD, LOCAL_URL); without it nothing starts
  • Assumes a bootable local environment and an authenticated gh CLI with repository access
  • Only covers the listed acceptance criteria; no static analysis or in-depth code review is described
When to use it

Use it when a PR is ready and you want to confirm on a booted local environment that every acceptance criterion actually passes.

When not to use it

Avoid it when the project has no bootable local environment or the orchestrator config block is missing.

Security analysis

Caution
Quality score77/100

There is no destructive, obfuscated, or exfiltration behavior: no `curl | sh`, no `rm -rf`, no reading of secrets or tokens, no base64 payloads, and no attempt to disable safety controls. The risk is moderate and conventional for a dev workflow — it shells out to grep and `gh`, boots a local environment via a repo-provided boot command, and can write to a GitHub PR, but the PR write is explicitly confirmed by the user. The main real concern is trust in the project config file that supplies `BOOT_CMD`, which is executed without inspection.

Findings
  • •Executes a shell command (`BOOT_CMD`) pulled verbatim from a repo-local orchestrator config file (`.claude/skills/orchestrator/SKILL.md`) with no validation, so an untrusted/modified config can inject arbitrary commands into the agent's shell context.
  • •Uses `gh` CLI against the GitHub API (read PR metadata, and write/update PR comments) — network plus external-service write capability, though posting is gated behind an explicit yes/no confirmation.
  • •No `allowed-tools` declared, so the skill implicitly relies on the host agent's full Bash/network permissions rather than a scoped tool set.
  • •Delegates core execution to an unspecified `qa-engineer` sub-agent whose behavior is not contained in this file, so the audited surface is incomplete.
How this analysis is made

Examples

QA a specific PR
/qa 142
QA the current branch's PR
/qa — validate the acceptance criteria for the PR on my current branch and show me the report without posting it to GitHub
QA from a PR URL
/qa https://github.com/acme/webapp/pull/378 and tell me which criteria fail

name: qa description: Run QA validation on a pull request — boots the local environment, tests acceptance criteria, and optionally posts the report as a PR comment. Standalone entry point for the qa-engineer agent. argument-hint: <PR-number-or-URL>

QA

Standalone QA run for any PR. Boots the local environment, validates every acceptance criterion, and produces a test report. Posting to GitHub is your choice — you are prompted at the end.

Step 1 — Load config

Read project config from the orchestrator's ## Project Config block:

ORCHESTRATOR=".claude/skills/orchestrator/SKILL.md"
REPO=$(grep '^REPO=' "$ORCHESTRATOR" | cut -d= -f2)
TEMP_ROOT=$(grep '^TEMP_ROOT=' "$ORCHESTRATOR" | cut -d= -f2)
BOOT_CMD=$(grep '^BOOT_CMD=' "$ORCHESTRATOR" | cut -d= -f2-)
LOCAL_URL=$(grep '^LOCAL_URL=' "$ORCHESTRATOR" | cut -d= -f2)

Step 2 — Resolve the PR

Use $ARGUMENTS as the PR number or URL. If empty, resolve from the current branch:

gh pr list --head "$(git branch --show-current)" --json number,url -q '.[0] | "\(.number) \(.url)"'

If no PR is found, tell the user and stop.

Get the base branch:

gh pr view <PR_NUMBER> --json baseRefName -q .baseRefName

Step 3 — Invoke the qa-engineer agent

Invoke the qa-engineer sub-agent with:

  • PR number and PR URL
  • Base branch from Step 2
  • Runtime values: TEMP_ROOT={TEMP_ROOT}, REPO={REPO}, E2E_BOOT={BOOT_CMD}, E2E_URL={LOCAL_URL}

STANDALONE MODE — two differences from the normal pipeline run:

  1. Skip Step 6 (posting the PR comment). Instead, output the full QA report as formatted Markdown in your response, in a section titled ## QA Report. Use the same format the pipeline would post (including the <!-- ai-pipeline:qa-report --> marker).
  2. Skip the StructuredOutput JSON return. Output a short human-readable summary instead: overall result, pass/fail per criterion, and any blockers.

All other steps run normally — the environment is booted ({BOOT_CMD}), acceptance criteria are tested, and the full validation is performed.

Step 4 — Offer to post

After the agent responds, display its ## QA Report and ask:

Post this QA report to PR #<PR_NUMBER>? Reply yes to post, no to finish here.

If yes — post with dedup: check for an existing <!-- ai-pipeline:qa-report --> comment, update it with PATCH if found, otherwise create a new comment.

If no — confirm the QA run is complete and finish.

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/qa-pr-validation-mrwak8qd' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/qa-pr-validation-mrwak8qd/download' --output '.skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md.part' && mv '.skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md.part' '.skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md' && test -s '.skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/qa' && cp -R '.skill-downloads/qa-pr-validation-mrwak8qd' '.claude/skills/qa'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/qa-pr-validation-mrwak8qd'

openskills read 'qa-pr-validation-mrwak8qd'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/qa-pr-validation-mrwak8qd/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills