New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Oma QA

by first-fluke in first-fluke/oh-my-agent

Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment.

MITAuto-check passedSecurity

Install Oma QA

skills CLI
$ npx skills add first-fluke/oh-my-agent --skill oma-qa -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install first-fluke/oh-my-agent oma-qa --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/first-fluke/oh-my-agent.git skills-src && mkdir -p .claude/skills && cp -r skills-src/benchmarks/runs/oma/.agents/skills/oma-qa .claude/skills/oma-qa && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
oma-qa
GitHub stars
1.3k
Token cost
~1.6k tokens
SKILL.md length
696 words
Files
8
Skills in repo
57
Repo updated
First seen
Licence
MIT

At a glance

Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment.

  • Works in 3 steps: Identify review scope and quality… → Collect diff, files, commands, and… → Choose automated checks before manual…
  • ISO/IEC 29119-aligned QA recommendations
  • SKILL.md covers Scheduling, Structural Flow, Logical Operations and References
  • Calls npm and lighthouse

What it does

Oma QA is an agent skill from first-fluke/oh-my-agent. Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO/IEC 25010 or ISO/IEC 29119-aligned QA recommendations.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 8 other files (for example `resources/checklist.md`, `resources/error-playbook.md` and `resources/examples.md`).

It sits in Security, covering Web application vulnerabilities, QA and bug reports and Security review. The repository describes itself as: Mechanical verification for AI coding agents — skills pack or full harness (stop-hook gates, artifact checks, independent judges). The licence is MIT.

When your agent uses it

  • ISO/IEC 29119-aligned QA recommendations
  • Tasks that involve Web application vulnerabilities
  • Tasks that involve QA and bug reports

Example prompts

  • “/oma-qa”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Identify review scope and quality dimensions.
  2. Collect diff, files, commands, and standards context.
  3. Choose automated checks before manual review where practical.

What it can do on your machine

Read from SKILL.md and the folder at commit b364119. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npm
    • lighthouse

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Oma QA loads about 1.6k tokens when it runs. Until then it costs about 65 tokens; SKILL.md has 696 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~65
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from first-fluke/oh-my-agent at commit b364119, republished under its MIT licence (© first-fluke). 696 words, ~1,615 tokens.

Download SKILL.mdSave it as .claude/skills/oma-qa/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
oma-qa
description
Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Use for test, review, security audit, OWASP, coverage, lint work, and ISO/IEC 25010 or ISO/IEC 29119-aligned QA recommendations.

QA Agent - Quality Assurance Specialist

Scheduling

Goal

Review and verify software quality with priority on security, performance, accessibility, correctness, test coverage, and standards-aligned quality evidence.

Intent signature
  • User asks for review, QA, security audit, OWASP, performance, accessibility, coverage, lint, testing, or ISO/IEC quality recommendations.
  • User needs findings with evidence, severity, file references, and concrete remediation.
When to use
  • Final review before deployment
  • Security audits (OWASP Top 10)
  • Performance analysis
  • Accessibility compliance (WCAG 2.1 AA)
  • Test coverage analysis
When NOT to use
  • Initial implementation -> let specialists build first
  • Writing new features -> use domain agents
Expected inputs
  • Diff, codebase area, PR, feature branch, build output, test results, or quality concern
  • Applicable standards such as OWASP, WCAG, ISO/IEC 25010, or ISO/IEC 29119
  • Verification commands and target environment when available
Expected outputs
  • Ordered findings with severity, evidence, file/line references, and fixes
  • Test, security, performance, accessibility, and quality recommendations
  • Verification summary and residual risks
Dependencies
  • resources/execution-protocol.md, examples, ISO guide, checklist, and self-check
  • Automated tools such as npm audit, bandit, lighthouse, linters, tests, and coverage tools when applicable
Control-flow features
  • Branches by review type, available diff, quality dimension, and tool availability
  • Reads code and reports; may run tools; generally should not implement broad feature work
  • Findings must be reproducible and prioritized

Structural Flow

Entry
  1. Identify review scope and quality dimensions.
  2. Collect diff, files, commands, and standards context.
  3. Choose automated checks before manual review where practical.
Scenes
  1. PREPARE: Define scope, severity rubric, and evidence requirements.
  2. ACQUIRE: Read diff/code and run relevant automated tools.
  3. REASON: Analyze security, performance, accessibility, correctness, and test coverage.
  4. VERIFY: Reproduce findings and reject false positives.
  5. FINALIZE: Report findings, remediation, test gaps, and residual risk.
Transitions
  • If security issues exist, prioritize them before performance/accessibility/code quality.
  • If an automated tool is unavailable, document that limit and do manual checks.
  • If no findings are found, state that and identify remaining test gaps or residual risk.
  • If standards-based review is requested, use resources/iso-quality.md.
Failure and recovery
  • If files or diff are unavailable, ask for scope or review the current working tree.
  • If a finding cannot be reproduced, do not report it as a finding.
  • If remediation needs domain implementation, route to the responsible specialist.
Exit
  • Success: findings are ordered, evidenced, reproducible, and actionable.
  • Partial success: unavailable tools or unverified areas are explicit.

Logical Operations

Actions
ActionSSL primitiveEvidence
Read review scope and codeREADDiff, files, reports
Select quality checksSELECTSecurity/performance/accessibility/test dimensions
Run automated toolsCALL_TOOLAudit, lint, tests, Lighthouse, coverage
Compare behavior to standardsCOMPAREOWASP, WCAG, ISO guides
Validate findingsVALIDATEReproducibility and evidence
Write review reportWRITEFindings and remediation
Notify outcomeNOTIFYFinal review summary
Show full SKILL.md (254 more words)Show less
Tools and instruments
  • Security, lint, coverage, performance, accessibility, and test tools
  • ISO quality guide, checklist, self-check, and examples
Canonical command path
bash
npm audit
bandit -r .
lighthouse <url>

Run only the tools that match the detected stack and available target. Add project lint/test/coverage commands before reporting findings when available.

Resource scope
ScopeResource target
CODEBASEReviewed source, tests, configs, and diff
PROCESSAutomated QA/security/performance/accessibility commands
LOCAL_FSReports, coverage output, review artifacts
USER_DATAUser-provided acceptance and quality criteria
Preconditions
  • Review scope and available evidence are identifiable.
  • Tools can run or their absence is documented.
Effects and side effects
  • Produces review findings and recommendations.
  • May run read-heavy or diagnostic commands.
  • Does not write broad implementation changes unless explicitly requested.
Guardrails
  1. Review in priority order: Security > Performance > Accessibility > Code Quality
  2. Every finding must include file:line, description, and fix
  3. Severity: CRITICAL (security breach/data loss), HIGH (blocks launch), MEDIUM (this sprint), LOW (backlog)
  4. Run automated tools first: npm audit, bandit, lighthouse
  5. No false positives - every finding must be reproducible
  6. Provide remediation code, not just descriptions
  7. When relevant, map findings to ISO/IEC 25010 quality characteristics and propose ISO/IEC 29119-aligned test improvements

References

Follow resources/execution-protocol.md step by step. See resources/examples.md for input/output examples. Use resources/iso-quality.md when the user needs enterprise QA, audit readiness, or standards-based recommendations. Before submitting, run resources/self-check.md. Vendor-specific execution protocols are injected automatically by oma agent:spawn. Source files live under ../_shared/runtime/execution-protocols/{vendor}.md.

  • Execution steps: resources/execution-protocol.md
  • Report examples: resources/examples.md
  • ISO quality guide: resources/iso-quality.md
  • QA checklist: resources/checklist.md
  • Self-check: resources/self-check.md
  • Error recovery: resources/error-playbook.md
  • Context loading: ../_shared/core/context-loading.md
  • Context budget: ../_shared/core/context-budget.md
  • Lessons learned: ../_shared/core/lessons-learned.md

© first-fluke, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files in benchmarks/runs/oma/.agents/skills/oma-qa of first-fluke/oh-my-agent.

  • SKILL.md
  • resources/checklist.md
  • resources/error-playbook.md
  • resources/examples.md
  • resources/execution-protocol.md
  • resources/iso-quality.md
  • resources/self-check.md
  • resources/verify-ship-protocol.md

Open the folder on GitHubat commit b364119

Compare with similar skills

Oma QA next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Oma QA compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Oma QA this skillfirst-fluke/oh-my-agent1.3k—~1.6kAutomated safety check: PassMIT
Kuri Agentjustrach/kuri365—~1.3kAutomated safety check: NotesCustom licence
Experience Lwc Security Validateforcedotcom/sf-skills1.1k—~2.6kAutomated safety check: PassApache-2.0
Generate Report Headermaslennikov-ig/claude-code-orchestrator-kit260—~1.2kAutomated safety check: PassCustom licence
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Reviewjewbetcha/opentrace11618 repos~3.1kAutomated safety check: NotesMIT

Similar skills

  • Kuri Agent

    justrach/kuri

    Use kuri-agent to automate Chrome — navigate pages, interact with elements via a11y refs, capture screenshots, run security audits, enumerate cookies/JWTs, probe for IDOR vulnerabilities, and make…

    365 GitHub stars~1.3k tokensUpdated 2 mo ago
    SecurityAuto-check: notes

  • Experience Lwc Security Validate

    forcedotcom/sf-skills

    Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (.js, .ts, .html, .css, .js-meta.xml) — the canonical LWS/Product-Security review for…

    1.1k GitHub stars~2.6k tokensUpdated 2 days ago
    Frontend & DesignAuto-check passed

  • Generate Report Header

    maslennikov-ig/claude-code-orchestrator-kit

    Create standardized report headers with metadata for all agent-generated reports.

    260 GitHub stars~1.2k tokensUpdated 7 mo ago
    SecurityAuto-check passed

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

  • Security Review

    jewbetcha/opentrace

    A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

    116 GitHub starsUsed in 18 repos~3.1k tokens
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    67k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed

More from first-fluke/oh-my-agent

All 57 skills in this repo

  • OMA Multi-Agent Orchestration

    first-fluke/oh-my-agent

    Decomposes a complex feature into tasks, dispatches parallel specialist agents with durable state, and supervises verification, QA review and retries.

    1.3k GitHub stars~4.1k tokensUpdated today
    Auto-check passed

  • OMA Multi-Agent Orchestrator

    first-fluke/oh-my-agent

    Splits a complex feature into prioritized tasks, spawns specialist CLI subagents in parallel, tracks them through shared memory and verifies each result.

    1.3k GitHub stars~3.1k tokensUpdated today
    Auto-check passed

  • Architecture Decisions and ADRs

    first-fluke/oh-my-agent

    Evaluates system boundaries and tradeoffs and writes architecture recommendations, option comparisons or ADRs, with a Mermaid diagram when structure changes.

    1.3k GitHub stars~2.6k tokensUpdated today
    Auto-check passed

  • OMA Backend Agent

    first-fluke/oh-my-agent

    Backend specialist for APIs, database work, authentication and migrations that follows clean architecture with router, service and repository layers.

    1.3k GitHub stars~2.4k tokensUpdated today
    Auto-check passed

  • oma Bootstrap

    first-fluke/oh-my-agent

    Installs or checks the oma CLI and its runtimes (bun, uv, serena) in a fresh workspace so that oma-* skills can run their commands.

    1.3k GitHub stars~719 tokensUpdated today
    Auto-check passed

  • Design-First Brainstorm

    first-fluke/oh-my-agent

    Explores intent, constraints and alternative approaches before any planning, working through questions one at a time and saving an approved design for later steps.

    1.3k GitHub stars~1.7k tokensUpdated today
    Auto-check passed

Categories

Questions about Oma QA

What does Oma QA do?

Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment. Oma QA is an agent skill from first-fluke/oh-my-agent. Quality assurance specialist for security, performance, accessibility, comprehensive testing, and quality standard alignment.

When should I use Oma QA?

Oma QA fits situations like: ISO/IEC 29119-aligned QA recommendations; tasks that involve Web application vulnerabilities; tasks that involve QA and bug reports.

How do I install Oma QA in Claude Code?

Run `npx skills add first-fluke/oh-my-agent --skill oma-qa -a claude-code`. Or copy the skill folder (benchmarks/runs/oma/.agents/skills/oma-qa in first-fluke/oh-my-agent) into .claude/skills/oma-qa in your project. Claude Code loads it when a task matches its description.

How do I install Oma QA in Codex?

Run `npx skills add first-fluke/oh-my-agent --skill oma-qa -a codex`. Or copy the skill folder (benchmarks/runs/oma/.agents/skills/oma-qa in first-fluke/oh-my-agent) into .agents/skills/oma-qa in your project. Codex loads it when a task matches its description.

Can I use Oma QA in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add first-fluke/oh-my-agent --skill oma-qa -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/oma-qa, .gemini/skills/oma-qa, .github/skills/oma-qa and .opencode/skills/oma-qa in your project.

What does Oma QA need to run?

Going by SKILL.md and its folder, Oma QA needs the command-line tools its instructions call (npm and lighthouse).

Does Oma QA access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Oma QA safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Oma QA use?

Oma QA is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Oma QA use?

About 1.6k tokens (SKILL.md is roughly 6.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Oma QA?

Skills that share tags, products or a category with Oma QA: Kuri Agent (justrach/kuri, 365 stars), Experience Lwc Security Validate (forcedotcom/sf-skills, 1.1k stars), Generate Report Header (maslennikov-ig/claude-code-orchestrator-kit, 260 stars) and Security Auditor (eigent-ai/eigent, 15k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Oma QA?

first-fluke (a GitHub organization) maintains it in first-fluke/oh-my-agent, which has 1,338 GitHub stars. The repository holds 57 skills in this directory. The repository was last updated on October 9, 2026.

Source: first-fluke/oh-my-agent on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.