resilience-audit
Audits web apps for resilience against unexpected user behavior — accidental, edge-case, and chaotic. Use this when the user says "resilience audit", "chaos audit", "what could go wrong", "edge case audit", "idiot-proof this", "break this app", "stress test the UX", or "find UX dead ends". Explores the codebase to map user flows, then systematically identifies ways the app can break, get stuck, or behave unexpectedly when users do things the developer didn't anticipate. Covers navigation dead ends, double-submits, interrupted operations, cross-device issues, input edge cases, timing bugs, error recovery gaps, and unintended usage patterns. Produces a prioritized report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.
- Installs
- 54
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/neonwatty/qa-skills --skill resilience-audit- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads resilience-audit automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Resilience Audit Skill
You are a senior QA engineer and UX resilience specialist auditing a web application for unexpected user behavior. Your approach is inspired by exploratory testing (James Bach's Heuristic Test Strategy Model) and defensive design (Murphy's Law applied to UX).
Your mindset: if a user can do it, a user will do it. You systematically walk through every flow asking "what happens if the user does something I didn't plan for?" — closes the tab, hits back, double-clicks, switches devices, pastes emoji, lets the session expire, or uses a feature for something it wasn't designed for.
This skill complements adversarial-audit (which focuses on business logic exploitation and cost). This skill focuses on app survivability — can the app handle real-world user chaos gracefully?
Task List Integration
CRITICAL: Use TaskCreate, TaskUpdate, and TaskList tools throughout execution.
| Task | Purpose |
|---|---|
| Main task | Resilience Audit — tracks overall progress |
| Explore: Flows & Navigation | Agent: routes, multi-step flows, navigation patterns |
| Explore: State & Persistence | Agent: client state, server state, sync mechanisms, caching |
| Explore: Inputs & Forms | Agent: form fields, validation, file uploads, user-generated content |
| Generate: Findings | Draft resilience findings |
| Verify: Interactive Testing | Optional browser-based verification |
| Approval: User Review | User reviews findings before final write |
| Write: Report | Final report output |
Session Recovery
At skill start, call TaskList. If a Resilience Audit task exists in_progress, check sub-task states and resume from the appropriate phase.
| Task State | Resume Action |
|---|---|
| No tasks exist | Fresh start (Phase 1) |
| Main in_progress, no explore tasks | Start Phase 2 |
| Some explore tasks complete | Spawn remaining agents |
| All explore complete, no generate | Start Phase 3 |
| Generate complete, no verify | Start Phase 4 or 5 |
| Verify complete, no approval | Start Phase 5 |
| Approval in_progress | Re-present summary |
| Approval approved, no write | Start Phase 6 |
| Main completed | Show final summary |
Process
Phase 1: Assess Current State
Create main task and mark in_progress.
- Identify the app's tech stack, client-side state management, and deployment model
- Check for existing error boundaries, retry logic, loading states, and offline handling
- Ask the user: Full audit (all 8 categories) / Focused audit (specific concern) / Quick scan (critical issues only)
- Ask for the app's base URL if interactive verification is desired
Phase 2: Explore the Application [DELEGATE TO AGENTS]
Create three exploration tasks, then spawn three Explore agents in parallel (all in a single message).
| Agent | Focus | Key Outputs |
|---|---|---|
| Flows & Navigation | Routes, multi-step flows, wizard/checkout patterns, back-button handling, deep-linkable states, redirect chains | Flow map with entry/exit points and state dependencies |
| State & Persistence | Client state (localStorage, cookies, React state, URL params), server state, caching layers, session management, real-time sync | State map with lifecycle, expiry, and sync mechanisms |
| Inputs & Forms | Form fields, validation (client vs server), file uploads, rich text, user-generated content, autofill behavior | Input inventory with validation coverage |
See references/agent-prompts.md for full agent prompt templates.
After all agents return, synthesize into a flow-state map — a unified view of every user flow, what state it depends on, and where inputs enter the system.
Phase 3: Generate Findings
For each area of the flow-state map, systematically generate findings across eight categories. See references/resilience-categories.md for full category definitions, checklists, and the severity rubric.
Categories:
- Navigation & Flow Dead Ends — back button breaks, stale bookmarks, deep-link to mid-flow, unreachable states
- Race Conditions & Double Actions — double-submit, rapid clicks, concurrent tab mutations, optimistic UI conflicts
- Interrupted Operations — tab close mid-save, network drop mid-upload, payment success + webhook failure
- Cross-Device & Cross-Session — desktop-to-mobile handoff, multiple sessions, stale localStorage, session conflicts
- Input & Data Edge Cases — unicode/emoji, paste vs type, autofill, extreme lengths, zero/null/empty, MIME spoofing
- State & Timing — cache expiry during write, session timeout mid-form, timezone/DST, eventual consistency windows
- Error Recovery & Empty States — unrecoverable errors, unhelpful messages, missing empty states, retry that doesn't work
- Unintended Usage Patterns — features used for wrong purpose, power-user shortcuts that bypass guardrails, workaround flows
For each finding, document: scenario, user type (confused/power/chaotic), severity, affected code, and recommended fix. See examples/finding-examples.md for the expected format.
Phase 4: Interactive Verification (Optional) [DELEGATE TO AGENT]
If the user provided a base URL, spawn a general-purpose agent to verify the top Critical and High findings in a real browser session.
See references/verification-prompts.md for the verification agent prompt.
The agent should attempt each scenario, record whether the app handles it gracefully or breaks, capture screenshots as evidence, and classify each finding as Verified, Handled Gracefully, or Not Reproducible.
Phase 5: Review with User (REQUIRED)
Present a summary including: total findings by severity, top 3 most impactful, categories covered, and verification results (if run).
Use AskUserQuestion with options: Approve / Investigate specific findings / Re-run with different focus / Add custom scenarios.
If changes requested, iterate. Only write final report after explicit approval.
Phase 6: Write Report and Complete
Write the approved report to /reports/resilience-audit.md. Mark all tasks completed.
See references/report-structure.md for the full report template.
Final summary:
## Resilience Audit Complete
**File:** /reports/resilience-audit.md
**Findings:** [count] ([critical] critical, [high] high, [medium] medium, [low] low, [info] info)
**Categories covered:** [count]/8
**Interactive verification:** [yes/no] ([verified]/[total] confirmed)
### Top Findings
[Top 3 by severity with one-line descriptions]
### Flow Coverage
- Multi-step flows audited: [count]
- State dependencies mapped: [count]
- Input surfaces checked: [count]
### Recommendations
- Immediate fixes needed: [count]
- UX improvements: [count]
- Defense-in-depth: [count]
Reference Materials
- references/resilience-categories.md — Full category definitions, checklists per category, severity rubric
- references/agent-prompts.md — Prompts for Phase 2 exploration agents and Phase 4 verification agent
- references/verification-prompts.md — Interactive verification agent prompt and evidence capture guide
- references/report-structure.md — Full report template with section descriptions
- references/race-condition-patterns.md — PortSwigger-derived taxonomy of web app race conditions
- examples/finding-examples.md — Complete example findings across all eight categories
Phase 8: Session Reflection
Read references/reflection-protocol.md and execute it before finishing.
FAQ
What does the resilience-audit skill do?
Audits web apps for resilience against unexpected user behavior — accidental, edge-case, and chaotic. Use this when the user says "resilience audit", "chaos audit", "what could go wrong", "edge case audit", "idiot-proof this", "break this app", "stress test the UX", or "find UX dead ends". Explores the codebase to map user flows, then systematically identifies ways the app can break, get stuck, or behave unexpectedly when users do things the developer didn't anticipate. Covers navigation dead ends, double-submits, interrupted operations, cross-device issues, input edge cases, timing bugs, error recovery gaps, and unintended usage patterns. Produces a prioritized report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.
How do I install resilience-audit?
Run npx skills add https://github.com/neonwatty/qa-skills --skill resilience-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/resilience-audit/ (personal) or .claude/skills/resilience-audit/ (project).
Which AI agents can use resilience-audit?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is resilience-audit safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains resilience-audit?
It is published by neonwatty in neonwatty/qa-skills. It has 54 recorded installs.
More from neonwatty/qa-skills
playwright-runner
neonwatty/qa-skills
Open the skill to read its SKILL.md instructions.
adversarial-audit
neonwatty/qa-skills
Audits SaaS and usage-based web apps for adversarial usage patterns — accidental, opportunistic, and deliberate. Use this when the user says "adversarial audit", "abuse case audit", "idiot-proof this app", "find usage exploits", "business logic audit", or "how could users break this". Explores the codebase to map the economic surface area (pricing tiers, usage limits, free trials, costly resources), then generates abuse cases where user behavior — intentional or not — could break assumptions, bypass limits, amplify costs, or corrupt state. Produces a prioritized markdown report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.
mobile-workflow-to-playwright
neonwatty/qa-skills
Converts mobile workflow markdown into a self-contained Playwright test project with mobile viewports (Chromium + WebKit), authentication scaffolding, UX anti-pattern assertions, and CI workflow. Use when the user says "convert mobile workflows to playwright", "translate mobile workflows to CI", or "generate mobile playwright tests".
keyword-wedge
neonwatty/qa-skills
Open the skill to read its SKILL.md instructions.
use-profiles
neonwatty/qa-skills
Open the skill to read its SKILL.md instructions.
multi-user-workflow-generator
neonwatty/qa-skills
Generates multi-user workflow documentation by interviewing the user about personas, exploring the codebase for multi-user patterns, then walking through the live app with per-persona Playwright CLI named sessions to co-author interleaved, persona-tagged workflows. Use when the user says "generate multi-user workflows", "create multi-user workflows", or "generate concurrent user workflows". Produces persona-tagged workflow markdown that feeds into the multi-user converter and Playwright runner.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.