Hostile Qa Tester

Hostile QA Tester

When to Use

Use this skill before a release, after a redesign, or when "it works for me" reports pile up. It role-plays the user your product team never invites: impatient, misclicking, tech-resistant, and determined to do the wrong thing. Output is a reproducible evidence log plus a severity-ranked bug report.

Do not use for: accessibility conformance audits (run a dedicated a11y pass); performance and load testing; security penetration testing (this is UI behavior, not exploitation); products with no UI to attack, such as pure APIs.

Procedure

1. Pick personas. Choose at most 3, extreme but believable: "Boss Bob" (clicks the first button, reads nothing), "Grandma Gina" (wrong taps, huge fonts, no keyboard), "Hacker Harry" (types quotes and scripts into every field and expects graceful errors).

2. Define scenarios from real user journeys. Per persona write 4–6 scenarios covering: the happy path with interruptions (back button, refresh mid-flow), empty states, extreme inputs (empty, 5000 chars, emoji, '; DROP TABLE), and cancellation paths (close a modal, sign out mid-checkout).

3. Execute with hostility rules: never follow an error message literally; retry the failed action twice; click adjacent elements; submit forms without filling them; use browser back/forward aggressively; resize the window mid-interaction; ignore onboarding hints on purpose. Record every step.

4. Capture evidence: screenshot before and after each suspicious action; note browser, OS, viewport, and the exact click coordinates; save console errors. Name files NN_persona_scenario_seq.png so a reviewer can replay your path.

5. Classify by severity:

Severity	Meaning	Example
S1 Blocker	Data loss, dead end, core task impossible	Checkout button dead after retry
S2 Major	Task possible only via a workaround	Error text is a raw stack trace
S3 Minor	Works but confusing or ugly	Misaligned button, unclear label
S4 Nit	Cosmetic, no task impact	Typos, inconsistent spacing

6. Write the report: for each bug — title, persona + scenario, numbered steps to reproduce, expected vs actual, evidence file names, severity, suggested fix. Rank S1s first, then S2s; merge duplicates; end with "what survived" (flows that withstood hostility) so the team sees wins too.

Reference

Hostile move	What it exposes
Submit empty form	Missing validation messages
Back button mid-flow	Lost state, stale pages
Refresh after step 2 of 5	Non-idempotent steps
Double-click submit	Double charges, duplicate records
Paste 1000-char text	Broken truncation / overflow
Append /admin to URL	Missing auth redirects

Evidence housekeeping: one folder per session, files named 01_bob_checkout_doubleclick.png, 02_gina_filter_tap.png, ..., plus a plain-text steps.log listing each action with a timestamp.

Verification Checklist

• Ran at least 3