MCPInstall

bmad-tea-nfr

Audit NFR evidence for performance, security, reliability, and maintainability. Use when implementation evidence exists and the user says "audit NFR evidence", "audit NFRs", or "evaluate non-functional requirements"

Installs
234
Last 24h
+23
Trending rank
#5245
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/bmad-code-org/bmad-method-test-architecture-enterprise --skill bmad-tea-nfr
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads bmad-tea-nfr automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

NFR Evidence Audit

Goal: Audit implemented non-functional requirement evidence (performance, security, reliability, maintainability) before release with evidence-based validation.

Role: You are the Master Test Architect.

You will continue to operate with your given name, identity, and communication_style, merged with the details of this role description.

Conventions

  • Bare paths (e.g. instructions.md) resolve from the skill root.
  • {skill-root} resolves to this skill's installed directory (where customize.toml lives).
  • {project-root} is the nearest folder containing _bmad/, starting at the project working directory and moving up through its parents.
  • {tea-knowledge} is the knowledge/ folder of the bmod-tea skill, installed beside this one: {skill-root}/../bmod-tea/knowledge. tea-index.csv there lists every fragment by a path relative to that folder.
  • {skill-name} resolves to the skill directory's basename.
  • Resolve sibling workflow files such as instructions.md, checklist.md, steps-c/..., steps-e/..., steps-v/..., and templates from {skill-root}.

On Activation

Before resolving customizations or running hooks, inspect {project-root}/_bmad/custom/ for bmad-testarch-nfr.toml and bmad-testarch-nfr.user.toml. If either exists, stop and tell the user to run npx --package=bmad-method-test-architecture-enterprise@3 tea-migrate-customizations --project-root {project-root}. Resolve any reported manual merge, then start a fresh chat. Do not continue with default settings while legacy overrides remain.

Step 1: Resolve the Workflow Block

Run: uv run {project-root}/_bmad/scripts/resolve_customization.py --skill {skill-root} --project-root {project-root} --key workflow

If the script fails, resolve the workflow block yourself by reading these three files in base → team → user order and applying the same structural merge rules as the resolver:

  1. {skill-root}/customize.toml — defaults
  2. {project-root}/_bmad/custom/{skill-name}.toml — team overrides
  3. {project-root}/_bmad/custom/{skill-name}.user.toml — personal overrides

Any missing file is skipped. Scalars override, tables deep-merge, arrays of tables keyed by code or id replace matching entries and append new entries, and all other arrays append.

Step 2: Execute Prepend Steps

Execute each entry in {workflow.activation_steps_prepend} in order before proceeding.

Step 3: Load Persistent Facts

Treat every entry in {workflow.persistent_facts} as foundational context you carry for the rest of the workflow run. Entries prefixed file: are paths or globs resolved from {project-root} — expand them and load every matching file in lexical path order as facts. All other entries are facts verbatim.

Step 4: Load Config

Run uv run {project-root}/_bmad/scripts/resolve_config.py --project-root {project-root} --key core --key modules.tea. If the script fails, merge {project-root}/_bmad/config.toml, {project-root}/_bmad/custom/config.toml and {project-root}/_bmad/custom/config.user.toml yourself, in that order, with the merge rules above. If _bmad/config.toml is missing or has no modules.tea table, tell the user TEA is not set up, ask them to run bmad setup tea first, and stop.

Each core and modules.tea key is available as {<key>}, and as config.<key> in later steps. Replace {project-root} inside a value with the project root. Setup answers are strings: read "true" and "false" as booleans.

If {tea-knowledge}/tea-index.csv does not exist, the TEA knowledge base is not installed. Tell the user, offer to install it with npx skills add bmad-code-org/bmad-method-test-architecture-enterprise --skill bmod-tea, run that on a yes, and stop until it is there.

Step 5: Greet the User

Greet {user_name}, speaking in {communication_language}.

Step 6: Execute Append Steps

Execute each entry in {workflow.activation_steps_append} in order.

Activation is complete. Begin the workflow below.

Workflow Architecture

This workflow uses tri-modal step-file architecture:

  • Create mode (steps-c/): primary execution flow for new runs and resume continuation
  • Validate mode (steps-v/): validation against checklist
  • Edit mode (steps-e/): revise existing outputs

Initialization Sequence

1. Mode Determination

"Welcome to the workflow. What would you like to do?"

  • [C] Create — Run the workflow from the beginning
  • [R] Resume — Resume an interrupted Create workflow
  • [V] Validate — Validate existing outputs
  • [E] Edit — Edit existing outputs

2. Route to First Step

  • If C: Load {skill-root}/steps-c/step-01-load-context.md
  • If R: Load {skill-root}/steps-c/step-01b-resume.md (Create-mode continuation)
  • If V: Load {skill-root}/steps-v/step-01-validate.md
  • If E: Load {skill-root}/steps-e/step-01-assess.md

Each run writes its audit to {test_artifacts}/nfr/nfr-assessment-{run_key}.md, where run_key is system, epic-{epic_num}, or story-{story_key}. Step 1 resolves it before the first save, so an audit for one scope never overwrites or merges into another scope's audit. Browser evidence screenshots also live under {test_artifacts}/nfr/.

Resume mode selects the output document matching the run being resumed, asks when several exist and no scope was named, and refuses to continue a document whose runKey belongs to a different run.

FAQ

What does the bmad-tea-nfr skill do?

Audit NFR evidence for performance, security, reliability, and maintainability. Use when implementation evidence exists and the user says "audit NFR evidence", "audit NFRs", or "evaluate non-functional requirements"

How do I install bmad-tea-nfr?

Run npx skills add https://github.com/bmad-code-org/bmad-method-test-architecture-enterprise --skill bmad-tea-nfr in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/bmad-tea-nfr/ (personal) or .claude/skills/bmad-tea-nfr/ (project).

Which AI agents can use bmad-tea-nfr?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is bmad-tea-nfr safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains bmad-tea-nfr?

It is published by bmad-code-org in bmad-code-org/bmad-method-test-architecture-enterprise. It has 234 recorded installs.

More from bmad-code-org/bmad-method-test-architecture-enterprise

View all →

bmad-tea

bmad-code-org/bmad-method-test-architecture-enterprise

Master Test Architect and Quality Advisor. Use when the user asks to talk to Murat or requests the Test Architect.

Testing & QA439 installs

bmod-tea

bmad-code-org/bmad-method-test-architecture-enterprise

Required bmod metadata. Never invoke this skill.

Testing & QA395 installs

bmad-tea-automate

bmad-code-org/bmad-method-test-architecture-enterprise

Generate tests in red or expand mode and run-and-heal new tests. Use when the user says "lets expand test coverage", "I want to automate tests", "lets write acceptance tests", or "I want to do ATDD"

bmad-tea-test-design

bmad-code-org/bmad-method-test-architecture-enterprise

Create system-level or epic-level test plans. Use when the user says "lets design test plan" or "I want to create test strategy"

Testing & QA248 installs

bmad-tea-test-review

bmad-code-org/bmad-method-test-architecture-enterprise

Review test quality using best practices validation. Use when user says "lets review tests" or "I want to evaluate test quality"

Testing & QA240 installs

bmad-tea-evaluate

bmad-code-org/bmad-method-test-architecture-enterprise

Run scored behavioral evaluations and repair gaps. Use when the user says "evaluate this agent" or "I want proof this behaves correctly"

Testing & QA239 installs

Popular security skills

View category →

azure-compliance

microsoft/azure-skills

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

OfficialSecurity567K installs

minimal-run-and-audit

lllllllama/rigorpilot-skills

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

Security477.4K installs

seo-audit

coreyhaines31/marketingskills

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security238.7K installs

firebase-security-rules-auditor

firebase/agent-skills

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

OfficialSecurity139.1K installs

audit

pbakaus/impeccable

Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.

Security81.9K installs

competitors

coreyhaines31/marketingskills

When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.

Security79.3K installs