Agent skill · Security

quality-playbook

Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.

GitHub68,948★ · +463/wk · 2 repos on radarProfile →
copilotships scriptsMIT
Install
npx skills add github/awesome-copilot --skill quality-playbook --agent copilot

Same command for any agent — swap --agent for claude-code, codex, cursor.

Facts
Files in the skill folder: 31
SKILL.md size: 286 KB
Bundled scripts: yes
Version: 1.5.6
Declared author: Andrew Stellman
Path: skills/quality-playbook/SKILL.md
Open the folder on GitHub →
Where it comes from
Stars: 37,432 · +281 this week
Language: Python

Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.

Review
written from the skill's own SKILL.md · Aug 4, 2026

What it does

The skill conducts a full quality engineering audit of a codebase. It derives behavioral requirements from the code, generates spec-traced functional tests, performs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. It aims to find defects that structural reviews alone miss and works with any language. It can be triggered by phrases like 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.

How it works

The plan comprises multiple phases that produce artifacts the next phase consumes:

  • Phase 0: Load seed results from prior runs if available.
  • Phase 1 (Explore): Ingest documentation, explore the codebase in three stages (open exploration, domain-knowledge risk analysis, structured exploration patterns), and write findings to quality/EXPLORATION.md.
  • Phase 2 (Generate): Read EXPLORATION.md and generate artifacts: requirements, constitution, functional tests, code review protocol, integration tests, spec audit protocol, and TDD protocol.
  • Phase 3 (Code Review): Run a three-pass code review against HEAD and write regression tests for confirmed bugs; generate patches.
  • Phase 4 (Spec Audit): Three AI auditors review code against requirements; triage with verification probes; run semantic citations check and write regression tests for net-new findings.
  • Phase 5 (Reconciliation): Track and regression-test bugs; finalize completeness report.
  • Phase 6 (Verify): Self-check benchmarks for consistency and version stamps.
  • Phase 7 (Present, Explore, Improve): Present results with a summary table and provide improvement paths; interactive for user-driven follow-up.

Every bug traces back to a requirement; requirements trace to exploration findings.

When to use it

Triggered by specific phrases: 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'. The workflow prescribes starting with open-ended domain-driven exploration, followed by domain-knowledge risk analysis, then structured patterns to identify defects early in exploration.

What it can touch

The skill declares the tool copilot in its metadata and uses it as the execution agent. It directs writing outputs into the quality/ directory and generates artifacts across multiple phases; execution relies on the orchestrator or local phase prompts.

Caveats

License terms are in LICENSE.txt; the plan includes a multi-phase process with dependencies between artifacts and requires per-phase prompts. The workflow emphasizes not editing files outside the quality/ directory during a run; prior seeds, if present, are loaded automatically in Phase 0, and partial runs require hygiene steps if aborted.

From the SKILL.md

# Quality Playbook Generator ## Plan Overview — read this first, then explain it to the user Before reading any other section of this skill, understand the plan and its dependencies. Each phase produces artifacts that the next phase depends on. Skipping or rushing a phase means every downstream phase works from incomplete information. **Phase 0 (Prior Run Analysis):** If previous quality runs exist, load their findings as seed data. This is automatic and only applies to re-runs. **Phase 1 (Explore):** Run the v1.5.3 documentation intake first (`python -m bin.reference_docs_ingest <target>` to walk `reference_docs/` — `cite/` files produce `quality/formal_docs_manifest.json` records; top-level files are loaded as Tier 4 context via `reference_docs_ingest.load_tier4_context(<target>)`). Then explore the codebase in three stages: open exploration driven by domain knowledge, domain-knowledge risk analysis, and selected structured exploration patterns. Write all findings to `quality/EXPLORATION.md`. This file is the foundation — Phase 2 reads it as its primary input. **Phase 2 (Generate):** Read EXPLORATION.md and produce the quality artifacts: requirements, constitution, functional tes

What's inside
Steps it walks through
  1. Plan Overview — read this first, then explain it to the user
  2. How to run this — v1.5.4 self-encoded invocation contract
  3. Pick your execution mode
  4. Mode A — skill-direct walkthrough (UI-context)
  5. Mode B — runner-driven invocation (CLI-automation)
  6. Bootstrap mode (running QPB on itself)
  7. v1.5.4 mechanics (pointer-style, not duplicating the design doc)
  8. Guardrails (machine-checkable; treat as hard constraints)
  9. What this run produces — output artifact contract
  10. Locating reference files
  11. Why This Exists
  12. What This Skill Produces
  13. Complete Artifact Contract
  14. Sidecar JSON Canonical Examples
Ships with 24 files
  • LICENSE.txt
  • agents/calibration_orchestrator.md
  • agents/quality-playbook-claude.agent.md
  • agents/quality-playbook.agent.md
  • phase_prompts/README.md
  • phase_prompts/iteration.md
  • phase_prompts/phase1.md
  • phase_prompts/phase2.md
  • phase_prompts/phase3.md
  • phase_prompts/phase4.md
  • phase_prompts/phase5.md
  • phase_prompts/phase6.md
  • phase_prompts/single_pass.md
  • quality_gate.py
  • references/challenge_gate.md
  • references/code-only-mode.md
  • references/constitution.md
  • references/defensive_patterns.md
  • references/exploration_patterns.md
  • references/functional_tests.md
  • references/iteration.md
  • references/orchestrator_protocol.md
  • references/requirements_pipeline.md
  • references/requirements_refinement.md
first 24 of 31
Commands it runs
mkdir -p quality/results
cat > "quality/results/run-$(date -u +%Y-%m-%dT%H-%M-%S).json" <<'METADATA'
awk '/void vring_transport_features/,/^}$/' drivers/virtio/virtio_ring.c \
set -euo pipefail
if [ "$ACTUAL" != "$SAVED" ]; then
echo "MISMATCH: vring_transport_features_cases.txt"
diff <(echo "$ACTUAL") <(echo "$SAVED") || true
else
echo "OK: vring_transport_features_cases.txt"
fi
More from awesome-copilot
All skills →
About this skill
What does the quality-playbook skill do?

Run a complete quality engineering audit on any codebase. Derives behavioral requirements from the code, generates spec-traced functional tests, runs a three-pass code review with regression tests, executes a multi-model spec audit (Council of Three), and produces a consolidated bug report with TDD-verified patches. Finds the 35% of real defects that structural code review alone cannot catch. Works with any language. Trigger on 'quality playbook', 'spec audit', 'Council of Three', 'fitness-to-purpose', or 'coverage theater'.

How do I install it?

Run `npx skills add github/awesome-copilot --skill quality-playbook --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.

Where does this skill come from?

From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.

Is a popular skill a good skill?

Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.

Keep going