# Oma QA

Review changes for correctness, security, accessibility, and performance.

- Repository: https://github.com/first-fluke/oh-my-agent (1356 stars)
- Category: Design
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add first-fluke/oh-my-agent --skill oma-qa -g -a claude-code -y`
Codex: `npx skills add first-fluke/oh-my-agent --skill oma-qa -g -a codex -y`
Cursor: `npx skills add first-fluke/oh-my-agent --skill oma-qa -g -a cursor -y`
Gemini CLI: `npx skills add first-fluke/oh-my-agent --skill oma-qa -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add first-fluke/oh-my-agent`

## Description

Review changes for correctness, security, accessibility, and performance. Use for scoped quality reviews or verification plans; bug fixes use oma-debug.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# QA Agent - Quality Assurance Specialist

## Scheduling

### Goal
Review and verify software quality with priority on security, performance, accessibility, correctness, test coverage, and standards-aligned quality evidence.

### Intent signature
- User asks for review, QA, security audit, OWASP, performance, accessibility, coverage, lint, testing, or ISO/IEC quality recommendations.
- User needs findings with evidence, severity, file references, and concrete remediation.

### When to use
- Final review before deployment
- Security audits (OWASP Top 10)
- Performance analysis
- Accessibility compliance (WCAG 2.2 AA)
- Test coverage analysis

### When NOT to use
- Initial implementation -> let specialists build first
- Writing new features -> use domain agents

### Expected inputs
- Diff, codebase area, PR, feature branch, build output, test results, or quality concern
- Applicable standards such as OWASP, WCAG, ISO/IEC 25010, or ISO/IEC 29119
- Verification commands and target environment when available

### Expected outputs
- Ordered findings with severity, evidence, file/line references, and fixes
- Test, security, performance, accessibility, and quality recommendations
- Verification summary and residual risks

### Dependencies
- `resources/execution-protocol.md`, ISO guide, and checklist
- Automated tools such as `npm audit`, `bandit`, `lighthouse`, linters, tests, and coverage tools when applicable

### Control-flow features
- Branches by review type, available diff, quality dimension, and tool availability
- Reads code and reports; may run tools; generally should not implement broad feature work
- Findings must be reproducible and prioritized

## Structural Flow

### Entry
1. Identify review scope and quality dimensions.
2. Collect diff, files, commands, and standards context.
3. Choose automated checks before manual review where practical.

The rest: https://github.com/first-fluke/oh-my-agent/blob/HEAD/.agents/skills/oma-qa/SKILL.md