Top 9 Free Claude Skills for Testing & QA in 2026

Claude Code skills — SKILL.md instruction packages that teach an agent a specific workflow — have become the fastest way to level up a testing and QA practice in 2026. Since Anthropic launched Agent Skills as an open standard in October 2025, thousands of community skills have appeared, covering everything from Playwright E2E automation to accessibility auditing and test-driven development. The catch: quality varies wildly. Research published by Snyk found prompt injection in 36% of skills tested, and other studies suggest roughly a quarter of skills carry at least one vulnerability. That makes choosing the right skills — and verifying them before you install — a genuine security decision, not just a convenience. In this guide, we round up nine free options for testing and QA in 2026, starting with SkillzBench, a free directory and verification platform that helps you discover, vet, and benchmark skills safely, followed by eight genuinely useful free QA skills you can install today. Every pick is free, and every entry is described factually based on what its maintainers publish.

#1 SkillzBench — Editors' choice

SkillzBench (skillzbench.com) is AIQ Labs' free, independent directory of AI agent skills plus a free MCP tool that connects any agent to the skills you choose — and it earns the Editor's Choice spot because it solves the problem every QA team hits in 2026: which skills can you actually trust? Published research suggests around 26% of agent skills carry at least one vulnerability, and Snyk's ToxicSkills research found prompt injection in 36% of skills tested. Installing a random SKILL.md from GitHub into the same agent that runs your test suites is a real supply-chain risk. SkillzBench is being built to fix that. Its pillars are Discover, Verify, Benchmark, Equip, and Stay current: it continuously crawls and dedupes skills from GitHub, pins every version to a commit SHA, validates, license-checks, security-scans, and quality-judges each one, then tests every skill in a sandbox with the same model — with and without the skill — and publishes the Lift in percentage points. A trust score from 0-100 combines security, quality, license, maintenance, and community signals, while Lift is always shown separately, and money never touches scores. A free MCP server plus per-agent loadouts let you toggle exactly which skills and tools each agent sees. Everything — the directory, the MCP connector, benchmarks, and alerts — is free; revenue comes only from ads around blog articles, never from users.

Best for: QA engineers, developers, and agent builders who want to find and verify testing skills safely before installing them into their agents

Pricing: Free — the directory, MCP connector, benchmarks, and alerts are all free; revenue comes from advertising around blog content, never from users

Key features

• Free, independent directory of AI agent skills crawled and deduped from GitHub
• Every skill version pinned to a commit SHA for reproducibility
• Security scanning, license checks, validation, and quality judging for every skill
• Sandbox benchmarking that publishes Lift in percentage points, measured with and without the skill
• Trust score 0-100 built from security, quality, license, maintenance, and community signals
• Free MCP server connecting any agent to the skills you choose
• Per-agent loadouts: toggle skills and tools per agent so each agent only sees what was chosen
• Upstream change tracking with re-scans, re-benchmarks, and notifications

Pros

• Completely free, with an ad-supported model that never influences scores or listings
• Independent verification addresses the documented security risks in the skills ecosystem
• Lift benchmarks show the measurable impact of a skill, not just a rating
• Works across agents that support the Agent Skills standard, including Claude Code, Codex, Cursor, and Gemini CLI

Cons

• Pre-launch and actively being built — the waitlist and newsletter are live, but the product is not yet public
• Benchmark results are still being produced, so coverage of the skills ecosystem is growing

Visit SkillzBench

#2 qa-skills (petrkindlmann/qa-skills)

qa-skills is a library of 42 QA and test-automation skills for AI coding agents, shared by its author on the Agent Skills GitHub discussions in May 2026. According to its repository, the collection spans 10 categories: Playwright and Cypress automation (E2E testing, page object models, CI integration), API, unit, and mobile testing (REST/GraphQL, Jest/Vitest, Appium/Detox), AI-augmented QA skills such as ai-test-generation, ai-bug-triage, test-reliability, and ai-qa-review, plus infrastructure skills for CI/CD pipelines, test environments, and contract testing. It also covers specialized areas including accessibility (WCAG 2.1), security (OWASP), visual regression, and performance, and production-oriented skills like synthetic monitoring, trace-based testing, and chaos engineering. The author notes all 42 skills follow the Agent Skills Standard format, so they work drop-in with Claude Code, OpenAI Codex, Cursor, Gemini CLI, and other compatible runtimes, and that the pack was built from patterns across six-plus production QA setups. Installation is via npx skills add petrkindlmann/qa-skills, and the project is MIT-licensed. The standout angle, per the author, is that it is the first comprehensive QA skill pack that also addresses how AI agents can help with the testing work itself — generating tests, triaging bugs, and detecting flaky tests.

Best for: QA engineers and teams who want a broad, standardized skill pack covering the full testing lifecycle

Pricing: Free (MIT-licensed open source)

Key features

• 42 QA and test-automation skills across 10 categories
• Playwright and Cypress automation skills including E2E testing, POM, and CI integration
• API, unit, and mobile testing coverage (REST/GraphQL, Jest/Vitest, Appium/Detox)
• AI-augmented QA skills: ai-test-generation, ai-bug-triage, test-reliability, ai-qa-review
• Specialized skills for accessibility (WCAG 2.1), security (OWASP), visual regression, and performance
• Production and observability skills: synthetic monitoring, trace-based testing, chaos engineering
• Follows the Agent Skills Standard for drop-in use with Claude Code, Codex, Cursor, and Gemini CLI

Pros

• Unusually broad coverage, from unit tests to chaos engineering
• Cross-agent compatibility via the Agent Skills Standard
• Includes AI-augmented QA skills that treat testing the tests as a first-class concern
• MIT license with simple npx installation

Cons

• Installing all 42 skills at once would add token overhead; teams should pick selectively
• Community-maintained, so individual skill quality should be reviewed before adoption

Visit qa-skills (petrkindlmann/qa-skills)

#3 test-driven-development (obra/superpowers)

The test-driven-development skill from the obra/superpowers repository was the single highest-installed testing skill in AI Skill Market's 2026 catalog analysis, with a reported 167.5K install signal and a 4/5 quality score. Rather than running tests, this skill encodes the TDD discipline itself: according to AI Skill Market's review, its instruction is to use it 'when implementing any feature or bugfix, before writing implementation code,' and the effect is that Claude actually writes the failing test first instead of skipping ahead to the implementation it assumes is right. It belongs to the Superpowers framework, a development methodology encoded as skills that multiple 2026 guides rank among the best Claude Code skills overall. The broader Superpowers framework enforces a structured workflow — Brainstorm, Spec, Plan, TDD, Subagent Development, Review, Finalize — and, per AY Automate's review, literally deletes code written before tests exist, making TDD non-optional. AI Skill Market's analysis observed that the top two testing skills are methodology skills rather than test-runner wrappers, suggesting developers using Claude Code for testing want discipline more than tooling. If you adopt this skill, note that AI Skill Market advises installing either it or the similar Hermes TDD skill — not both — since they conflict on the same task.

Best for: Developers and QA engineers who want Claude to enforce test-first development on every feature and bugfix

Pricing: Free (open source)

Key features

• Encodes the write-the-test-first TDD discipline as an installable skill
• Highest-installed testing skill in AI Skill Market's 2026 catalog (167.5K signal, 4/5 quality)
• Part of the broader Superpowers development methodology framework
• Triggers on any feature or bugfix implementation task
• Pairs naturally with test-runner and Playwright wrapper skills

Pros

• Strongest install and quality signal among testing-focused skills in 2026 rankings
• Changes agent behavior (writes tests first) rather than just wrapping a CLI
• Short, focused skill with a simple, profound discipline
• Backed by a large, actively maintained framework

Cons

• Strict TDD enforcement can feel heavy for quick prototypes or throwaway scripts
• Conflicts with the similar Hermes TDD skill if both are installed
• Methodology skill only — you still need test-runner skills to actually execute suites

Visit test-driven-development (obra/superpowers)

#4 playwright-e2e-testing (QASkills)

According to QASkills.sh's 2026 guide, playwright-e2e-testing is the single most-installed Claude Code testing skill of the year, with a reported quality score of 96 and an average install time under five minutes. The skill teaches Claude how to scaffold a Playwright project, write resilient locators, handle authentication state, run parallel tests, and produce a trace. Per QASkills.sh, what it gives Claude includes a locator strategy preferring getByRole, getByLabel, and getByTestId; a storage-state pattern for authenticated tests; parallel sharding inside CI; trace-on-first-retry configuration; and webserver lifecycle handling for local development. QASkills.sh illustrates the workflow in a real-world example: a QA engineer at a Series B fintech asks Claude to write Playwright tests for a new billing page, and the skill picks resilient locators automatically — part of a loop the site says used to consume two engineers for a full day in 2023 and now takes one engineer ninety minutes. Installation is handled through the QASkills CLI (npm install -g @qaskills/cli, then npx @qaskills/cli add playwright-e2e-testing --agent claude-code), which places the skill in the correct global or project-level directory so Claude Code picks it up automatically.

Best for: Frontend and full-stack QA teams using Playwright who want Claude to write production-quality E2E tests

Pricing: Free

Key features

• Playwright project scaffolding guidance for Claude Code
• Resilient locator strategy preferring getByRole, getByLabel, and getByTestId
• Storage-state pattern for authenticated tests
• Parallel sharding configuration for CI
• Trace-on-first-retry setup
• Webserver lifecycle management for local development
• One-step install via the QASkills CLI

Pros

• Reported as the most-installed Claude Code testing skill in 2026
• Covers the full E2E workflow from scaffolding to CI sharding
• High reported quality score (96) in QASkills.sh's ranking
• Fast to install and verify via the /skills command

Cons

• Playwright-specific — QASkills.sh warns against installing it alongside a Cypress E2E skill in the same repo, since Claude picks whichever it sees first alphabetically
• Requires the QASkills CLI init step, which teams sometimes skip and then wonder why the skill never loads

Visit playwright-e2e-testing (QASkills)

#5 webapp-testing (Anthropic official)

webapp-testing is an official Anthropic skill for testing local web applications with Playwright, and it appears in multiple 2026 best-of lists, including Zima Store's top-10 AI agent skills roundup. According to that guide, the skill helps Claude Code interact with a running app, capture screenshots, inspect console logs, debug UI behavior, and verify frontend functionality. Its recommended use cases include login flows, forms, dashboard behavior, browser errors, UI regression testing, and local app verification. The value proposition, as Zima Store frames it, is that Claude Code may edit the correct files but still leave the app broken — a browser-testing skill pushes the workflow from 'I changed the code' to 'I opened the app and verified the behavior.' Because it comes from Anthropic's official skills repository, it carries stronger trust signals than anonymous community uploads, a point Zima Store emphasizes when noting that official repos from Anthropic, Vercel, Supabase, Sentry, and others are safer defaults. It is also concrete rather than generic: rather than a vague 'testing' capability, it defines a specific workflow — driving a real browser against your locally running app — which is exactly the kind of precise trigger that makes Claude skills activate reliably.

Best for: Developers who want Claude to verify its own frontend changes in a real browser before declaring work done

Pricing: Free (open source, official Anthropic repository)

Key features

• Official Anthropic skill from the anthropics/skills repository
• Drives a real browser via Playwright against your local web app
• Captures screenshots and inspects console logs
• Debugs UI behavior and verifies frontend functionality
• Suited to login flows, forms, dashboards, and UI regression checks
• Concrete trigger: use when verifying that a change actually works in the running app

Pros

• Official Anthropic provenance with stronger trust signals than anonymous community skills
• Closes the gap between 'code edited' and 'behavior verified'
• Well-defined trigger that activates reliably
• No extra tooling required beyond Playwright

Cons

• Focused on local app verification rather than full CI-scale E2E suites
• Playwright-based, so teams on other browser-automation stacks get less direct value

Visit webapp-testing (Anthropic official)

#6 Playwright Best Practices (Currents)

Playwright Best Practices is a plugin from currents-dev/playwright-best-practices-skill, ranked #3 in AI Skill Market's 2026 testing and TDD comparison with a reported 33.2K install signal and a 4/5 quality grade. According to AI Skill Market, the skill is published by Currents, a Playwright observability vendor, which means its authors run thousands of test suites at scale and know where the failure modes actually are. The skill covers reliable selectors, parallel execution, CI configuration, and — the differentiator AI Skill Market highlights — flake prevention. Anti-flake guidance matters because flaky tests are described as the single biggest reason teams give up on E2E testing; a skill that encodes how to avoid instability is more valuable than a generic CLI wrapper that merely runs tests. AI Skill Market's analysis groups this entry among the test-runner wrappers in its top 15, but notes it is '4/5-quality-grade detailed' compared with shallower generic entries. The recommended pairing in that analysis is with the official Microsoft Playwright CLI skill (#4 in its ranking): the CLI runs the tests, Best Practices ensures they are not flaky — and AI Skill Market suggests installing both.

Best for: Teams running Playwright suites in CI who struggle with flaky tests and inconsistent results

Pricing: Free

Key features

• Playwright best practices from Currents, a Playwright observability vendor
• Reliable selector guidance
• Parallel execution patterns
• CI configuration guidance
• Anti-flake prevention guidance — the standout differentiator
• Ranked #3 testing skill in AI Skill Market's 2026 comparison (33.2K signal, 4/5 quality)

Pros

• Authored by a vendor that operates Playwright at scale
• Directly targets the flakiness problem that kills E2E adoption
• Detailed, high-quality guidance (4/5 in AI Skill Market's rubric)
• Pairs well with the official Microsoft Playwright CLI skill

Cons

• Playwright-only — teams on Cypress should look at broader pattern skills instead
• Vendor-authored, so it naturally frames workflows around practices common to Playwright ecosystems

Visit Playwright Best Practices (Currents)

#7 vitest-unit-testing (QASkills)

vitest-unit-testing is QASkills.sh's #2-ranked Claude Code testing skill for 2026, with a reported quality score of 94 and an average install time under two minutes. According to QASkills.sh, Vitest has eaten most of the unit-testing market from Jest by 2026, which makes this skill the natural unit-test companion for TypeScript and JavaScript teams. The skill teaches Claude when to use describe.concurrent, how to set up MSW (Mock Service Worker) for fetch mocking, and how to write deterministic snapshot tests — three of the areas where generic prompting tends to produce brittle or nondeterministic results. In QASkills.sh's real-world workflow example, a QA engineer with this skill loaded asks Claude Code to look at the week's merged PRs and propose missing tests; with vitest-unit-testing active, Claude reads the diff and writes the missing unit tests itself, after which pnpm test fans out 12,000 tests in 90 seconds. Installation follows the same QASkills CLI loop as the other entries in that catalog: install the CLI globally, run init in your repo, then add the skill with the --agent claude-code flag. It pairs naturally with pytest-patterns for polyglot teams that need both JavaScript and Python unit coverage.

Best for: TypeScript and JavaScript teams standardizing on Vitest who want Claude to write reliable, deterministic unit tests

Pricing: Free

Key features

• Unit-testing skill for Vitest, the dominant JS/TS test runner of 2026
• Guidance on describe.concurrent usage
• MSW (Mock Service Worker) setup for fetch mocking
• Deterministic snapshot-test patterns
• Quality score of 94 in QASkills.sh's 2026 ranking
• Under-two-minute install via the QASkills CLI

Pros

• Targets the current mainstream JS/TS unit-testing stack
• Addresses common failure modes: nondeterminism and poor fetch mocking
• Proven in a documented real-world QA workflow
• Very fast to install and verify

Cons

• Vitest-specific — teams still on Jest need a different skill
• Unit-level scope only; pair with E2E and CI skills for full coverage

Visit vitest-unit-testing (QASkills)

#8 accessibility-axe-pa11y (QASkills)

accessibility-axe-pa11y is QASkills.sh's dedicated accessibility-testing skill, ranked #6 in its 2026 guide with a reported quality score of 92 and an average install time under five minutes. According to QASkills.sh, WCAG 2.2 AA is a default deliverable in 2026, and this skill teaches Claude to run axe-core inside Playwright, parse the violations, and convert each one into a GitHub issue — turning accessibility from a periodic audit into an automated, per-change workflow. The skill slots directly into the documented QA loop from that guide: after Claude writes Playwright tests for a new page, the engineer asks Claude to 'add axe-core to every new Playwright test,' and the accessibility skill takes over, embedding accessibility checks into the E2E suite rather than treating them as a separate workstream. The resulting violations-to-GitHub-issues pipeline also makes accessibility findings trackable in the same backlog as functional bugs, which is how high-performing teams keep WCAG compliance from slipping. For teams that also use pa11y, the skill covers that tooling as well, per its name and QASkills.sh's description. Installation follows the standard QASkills CLI flow, and it is included in the ci-github-actions-test-matrix skill's accessibility job for CI wiring.

Best for: Teams that need WCAG 2.2 AA compliance built into every pull request rather than bolted on before release

Pricing: Free

Key features

• Runs axe-core inside Playwright for automated accessibility checks
• Parses violations and converts each into a GitHub issue
• Supports pa11y alongside axe-core
• Aligns with WCAG 2.2 AA, described by QASkills.sh as a 2026 default deliverable
• Integrates into the E2E suite rather than running as a separate audit
• Wires into the GitHub Actions test matrix accessibility job

Pros

• Automates accessibility checks inside the existing Playwright suite
• Creates trackable GitHub issues from violations
• High reported quality score (92)
• Directly supports a documented, real-world QA workflow

Cons

• Requires Playwright to already be part of your stack
• Automated axe/pa11y checks catch a subset of WCAG issues; manual testing is still needed for full compliance

Visit accessibility-axe-pa11y (QASkills)

#9 Trail of Bits Security Skills

Trail of Bits Skills are security-audit plugins from the trailofbits/skills repository, added to AY Automate's best Claude Code skills list in September 2026 (checked 2026-09-26) and also cited in Firecrawl's 2026 developer guide. According to AY Automate, the skills run CodeQL and Semgrep static analysis for vulnerability detection, along with differential review and supply-chain audits. Firecrawl's guide similarly lists the Trail of Bits skill as the one that 'runs CodeQL and Semgrep analysis for vulnerability detection,' situating it among situational skills to use 'when the job calls for them.' Trail of Bits is a well-known security research firm, and both guides group its skills alongside partner skills from Vercel and Remotion as safe defaults — Firecrawl explicitly recommends the anthropics/skills repository and partner skills from Vercel, Trail of Bits, and Remotion as trusted sources when auditing community skills. For QA teams in 2026, security testing increasingly sits inside the quality gate rather than after it, and these plugins bring static-application-security-testing directly into the Claude Code workflow: the same agent writing your tests can also scan the code it just changed for vulnerabilities before you merge.

Best for: Engineering and QA teams that want security scanning folded into the same agent workflow as their functional testing

Pricing: Free (open source)

Key features

• Runs CodeQL static analysis for vulnerability detection
• Runs Semgrep analysis
• Differential review capability
• Supply-chain audit skills
• Published by security research firm Trail of Bits
• Cited by Firecrawl and AY Automate as a trusted partner-skill default

Pros

• Authoritative provenance from a leading security research firm
• Covers both SAST tooling (CodeQL, Semgrep) and supply-chain review
• Recommended as a safe default by multiple 2026 guides
• Extends QA into security testing without leaving Claude Code

Cons

• Security-focused rather than a general testing skill — pair with test-runner skills
• Static analysis can surface findings that need human triage to prioritize

Visit Trail of Bits Security Skills

Conclusion

Testing and QA is one of the strongest use cases for Claude skills in 2026 — the ecosystem now offers everything from TDD methodology enforcement to Playwright E2E automation, accessibility auditing, and security scanning, much of it free and open source. But the same ecosystem research also shows why verification matters: Snyk found prompt injection in 36% of skills tested, and other research puts vulnerability rates around 26%. The smart workflow is to verify before you install. That is exactly what SkillzBench is building: a free, independent directory that security-scans, license-checks, and sandbox-benchmarks every skill, publishing trust scores and Lift numbers so you can see a skill's real impact before it touches your agent. While you wait, the eight skills above — from qa-skills' 42-skill pack to Anthropic's official webapp-testing skill — are all free, well-documented starting points. And when you want agent skills that automate the rest of your QA workflow, browse and test free ones on SkillzBench. Join the waitlist or subscribe to the newsletter at skillzbench.com to be first in line when the directory and free MCP connector go live.

Frequently asked questions

What are Claude skills, and how do they work for testing and QA?

Claude skills are folders containing a SKILL.md file — instructions plus optional bundled scripts and reference files — that Claude Code loads on demand when a task matches the skill's description. At startup, Claude sees only each skill's name and description (roughly 100 tokens per skill), and loads the full instructions only when relevant, a mechanism called progressive disclosure. For testing and QA, skills encode repeatable workflows: how to scaffold a Playwright project, write resilient locators, run axe-core accessibility checks, or enforce test-driven development. Anthropic launched Agent Skills as an open standard in October 2025, and the format has since been adopted by Claude Code, OpenAI Codex, Cursor, and Gemini CLI, making skills portable across tools.

Are all the skills in this list really free?

Yes. Every entry here is free: the community and partner skills (qa-skills, superpowers' TDD skill, Playwright Best Practices, Trail of Bits Security Skills) are open source under licenses like MIT, and Anthropic's official webapp-testing skill is free from the anthropics/skills repository. SkillzBench is also entirely free — the directory, the MCP connector, benchmarks, and alerts cost nothing, because SkillzBench earns revenue from advertising shown around its blog articles, never by charging users, and ad money never influences scores or listings.

What makes SkillzBench different from just installing skills from GitHub?

Installing directly from GitHub means trusting an unverified SKILL.md and any bundled scripts. That is a real risk: published research found roughly 26% of agent skills carry at least one vulnerability, and Snyk's ToxicSkills research found prompt injection in 36% of skills tested. SkillzBench is being built to close that gap with a five-pillar approach — Discover, Verify, Benchmark, Equip, and Stay current. It pins every skill version to a commit SHA, security-scans and license-checks each one, benchmarks every skill in a sandbox with and without the skill to publish a Lift score in percentage points, and assigns a 0-100 trust score from security, quality, license, maintenance, and community signals. Lift is always shown separately from ratings, and money never touches scores. Note that SkillzBench is pre-launch: the waitlist and newsletter are live, but the product is not yet public.

How many Claude skills should I install for testing?

Fewer than you might think. QASkills.sh's 2026 guide lists 'installing every popular skill at once' as mistake number one: skills cost tokens, and if you install 40 skills, Claude has to scan all of them per task. The guide recommends sticking to the 8-12 skills that actually match your stack. It also warns against mixing E2E frameworks — don't install both a Playwright E2E skill and a Cypress E2E skill in the same repo, since Claude will pick whichever it sees first alphabetically. A practical starting set is one TDD methodology skill, one test-runner wrapper for your framework, one accessibility skill, and one CI wiring skill.

Can I use these skills with agents other than Claude Code?

Many of them, yes. The Agent Skills specification has been adopted by Claude Code, OpenAI Codex, Cursor, Gemini CLI, and other compatible agents. The qa-skills library explicitly states that all 42 of its skills follow the Agent Skills Standard format and work drop-in with Claude Code, OpenAI Codex, Cursor, and Gemini CLI. Skills from the official anthropics/skills repository and partner repos like Vercel and Trail of Bits are also written for the standard. SkillzBench's free MCP server and per-agent loadouts are designed for exactly this multi-agent world: you toggle skills and tools per agent, and each agent only sees what you chose for it.

How do I install a Claude Code skill?

There are a few routes. Manually, a skill lives at ~/.claude/skills/<name>/SKILL.md (personal, all your projects) or .claude/skills/<name>/SKILL.md (project-level, shared with your team via git). Via plugins, you can use the /plugin marketplace add owner/repo command in Claude Code. Some collections ship their own CLIs — for example, the QASkills skills install via npm install -g @qaskills/cli followed by npx @qaskills/cli add <skill-name> --agent claude-code, and qa-skills installs via npx skills add petrkindlmann/qa-skills. Always review a skill's SKILL.md and bundled scripts before installing, and verify the source — skills from the official Anthropic repo and established vendors like Trail of Bits and Currents are safer defaults than anonymous uploads.

Are Claude skills safe to install?

Not automatically — treat them like any third-party code. Snyk's ToxicSkills research found prompt injection in 36% of skills tested and 1,467 malicious payloads across the ecosystem, and other published research found roughly 26% of skills carry at least one vulnerability. Firecrawl's 2026 guide similarly warns about undocumented network calls baked into bundled scripts and recommends auditing every SKILL.md and script before installing community skills. Prefer official repositories (anthropics/skills) and established vendors (Trail of Bits, Vercel, Currents), and once SkillzBench launches, use its free security scanning, license checks, and trust scores to verify any skill before it reaches your agent.