QA Lab — Security skill for Claude Code

QA Lab

A local workspace for running product quality assurance and application security assessment with two AI coding agents that check each other's work.

QA Lab is a filesystem and a small standard library command line tool. It holds the standards, templates, per product test catalogs, run records, and evidence for an assessment. It does not launch agents and it does not run in the cloud. You open one agent session per product, point it at its folder, and the filesystem is the durable record of what was actually done.

Built and maintained by Joshua Theophilus.

The model

Most AI assisted testing uses one agent. One agent plans the tests, runs them, and grades itself. QA Lab runs two.

You use two agents from two different providers, and each one runs on the most capable model that provider offers. The reference setup is Codex on OpenAI's strongest model and Claude Code on Anthropic's strongest model. Each agent creates its own runs with its own test identities, records factual results through the command line tool, and then reviews the other agent's high risk findings and a sample of its critical passes. Neither agent can edit the other's original evidence.

The rule the whole workspace enforces is simple. Evidence determines a result, not agent agreement. A passing reachability check is not a passing product assessment. Agreement between the two agents cannot waive a mandatory check or a missing piece of evidence. The product owner makes the final release decision.

Shared engineering layer: ECC

QA Lab uses the ECC plugin as the engineering layer both agents work inside. ECC is an open source agent harness by Affaan Mustafa. It provides planning, test driven development, fresh context code review, and security scanning as reusable workflows, so the two agents follow the same process instead of improvising it each session.

Here is exactly how QA Lab uses it:

• Planning before any change to the lab tooling, through ECC's planning workflow.
• `/code-re