bug-report-template
Builds a well-formed bug (defect) report from raw observation notes - fills in summary, environment, steps to reproduce, expected vs actual, and severity rationale. Validates that each field has the load-bearing content reviewers and engineers need to triage. Use when a stakeholder reports a problem informally (chat, email, voice) and the team needs a triageable issue without round-tripping for missing fields.
Install with skills.sh (any agent)
npx skills add testland/qa --skill bug-report-templatebug-report-template
Overview
A well-formed bug report is the input contract for triage, repro, and fix. Industry consensus from Mozilla's long-standing bug-writing guide (mozilla-bug-writing (opens in new window)) and the ISO/IEC/IEEE 29119-3:2021 incident-report format converges on the same eight fields:
| Field | Purpose |
|---|---|
| Summary | Triage line - describes the problem, not the cause. |
| Environment | OS, build, browser/runtime version, locale, device. |
| Steps to Reproduce | Numbered, deterministic, copy-pasteable. |
| Expected | What should have happened. |
| Actual | What did happen (verbatim error message if any). |
| Severity | Impact on users (intrinsic to the bug). |
| Priority | Order of fix relative to other bugs (extrinsic, business). |
| Reproducibility | Always / Sometimes / Once / Unable. |
Terminology note: ISTQB distinguishes error (human action), defect / fault / bug (imperfection in a work product), and failure (deviation from delivered service). This skill uses "bug" and "defect" interchangeably with "fault" reserved for the code-level imperfection. Reports describe failures and the reporter's hypothesis about the underlying defect.
The skill is a workflow that takes raw input (a chat message, a voice memo transcription, a copy-pasted error) and produces a filled template - refusing to leave any required field blank.
When to use
If the team already has a working bug template in their tracker, this skill is not for replacing it - it's for filling it correctly. Adapt the field set below to the team's existing template.
How to use
Step 1 - Extract raw evidence
From the input (chat message, error log, screenshot caption, voice memo), extract:
If any of these is missing, flag the gap rather than fabricating; the gap is a triage signal in itself.
Step 2 - Draft the Summary
Per Mozilla's guidance, summaries should be under 60 characters and describe the problem, not the solution (mozilla-bug-writing (opens in new window)).
| Anti-pattern | Better |
|---|---|
Need to add cookies banner | Cookie consent banner missing on /pricing |
Fix the login form | Login form rejects valid email with apostrophe |
Bug in checkout | Checkout returns 500 when shipping address is empty |
A good summary names the surface (URL/screen) and the observable behavior (what's wrong).
Step 3 - Build the Steps to Reproduce
Per mozilla-bug-writing (opens in new window), reproduction steps must be:
Example contrasting good vs. bad:
Bad:
1. Go to the site and try to check out.
Good:
1. Open https://example.com/ in Firefox 128 (private window).
2. Click "Add to cart" on the first product card.
3. Click the cart icon (top right).
4. Click "Checkout".
5. Leave the shipping address fields empty.
6. Click "Place order".If the bug is intermittent, document the reproduction rate ("8 out of 20 attempts on macOS Sonoma 14.4 / Firefox 128") - quantify the rate, don't guess.
Step 4 - Separate Expected from Actual
Mozilla's example pattern (mozilla-bug-writing (opens in new window)):
Expected: My Inbox displays correctly.
Actual: The page shows "Your browser does not support cookies
(error -91)".Reject blurry phrasings like "it doesn't work" or "page displays incorrectly" - they push the cost of investigation onto the engineer instead of the reporter.
For UI bugs, attach a screenshot as the Actual body. For backend bugs, paste the exact error message + status code. If a stack trace is available, capture it verbatim as input for hypothesis extraction.
Step 5 - Pick Severity (intrinsic) and Priority (extrinsic)
Score two independent fields: Severity (what the defect does to the user when it manifests) and Priority (when the team plans to fix it relative to other work). They are not the same axis - a Critical-severity bug for a non-paying user can be P2, and a Minor-severity bug on the marketing homepage can be P0 the day before launch. Score severity from impact; let the PM / engineering decide priority from business context.
Use the classification scales in references/severity-and-priority-scales.md.
Step 6 - Score Reproducibility
Per mozilla-bug-writing (opens in new window):
A Once or Unable bug is not a candidate for fix-then-close - it's a candidate for adding monitoring or extending the test suite to catch it next time.
Output format
## <Summary, <60 chars, problem-not-solution>
**Severity:** Critical | Major | Moderate | Minor
**Priority:** P0 | P1 | P2 | P3
**Reproducibility:** Always | Sometimes (X/Y) | Once | Unable
### Environment
- **App / Build:** <name + version + commit SHA if known>
- **OS:** <macOS 14.4 / Windows 11 23H2 / Ubuntu 24.04 / iOS 18.0>
- **Browser / Runtime:** <Firefox 128 / Chrome 130 / Node 22.5.0 / Python 3.12>
- **Locale / Timezone:** <en-US / UTC+0> (only when relevant)
- **Device / Viewport:** <iPhone 13 / 1280x800 desktop> (only when relevant)
### Steps to reproduce
1. <step>
2. <step>
3. ...
### Expected
<one sentence - what should have happened>
### Actual
<verbatim error / observed behavior; attach screenshot or log>
### Notes
<optional: any context the reporter mentioned that doesn't fit elsewhere - recent changes, why they were doing this, what they tried>Worked example - from a Slack message
Input:
"hey, the checkout flow is broken on mobile - i hit the place order button and nothing happens. tried twice. firefox on my phone."
The skill identifies missing fields and produces a draft with gap flags for the missing data:
## Place order button does nothing on mobile checkout
**Severity:** Major (feature unusable; needs reporter confirmation)
**Priority:** P1 (until severity is confirmed)
**Reproducibility:** Sometimes (2 attempts confirmed by reporter)
### Environment
- **App / Build:** [GAP - confirm the build / version]
- **OS:** [GAP - "my phone" - confirm iOS or Android + version]
- **Browser:** Firefox (mobile)
- **Locale / Timezone:** [GAP - only if business-logic-relevant]
- **Device:** [GAP - confirm phone model]
### Steps to reproduce
1. [GAP - confirm starting URL or screen]
2. Add a product to the cart.
3. Navigate to checkout.
4. Tap "Place order".
5. Observe: nothing happens.
### Expected
Tapping "Place order" submits the order and navigates to the
confirmation screen.
### Actual
Tapping "Place order" produces no visible response (no nav, no error,
no spinner).
### Notes
Reporter tried twice. Returning to reporter for the gaps before triage.The [GAP] markers force the reporter to fill them in, rather than the engineer triaging on incomplete data.
Variant - from a stack-trace dump. Given an automated alert with the full production stack trace, the skill drafts the report with Steps to Reproduce marked Unable - production crash (no manual repro yet) and the Actual field populated with the verbatim trace, flagged for hypothesis extraction.
Anti-patterns
| Anti-pattern | Why it fails | Fix |
|---|---|---|
| Filing without environment fields | Engineer cannot reproduce; bug bounces back to reporter. | Force the GAP markers in the template; refuse to file without them. |
| Combining multiple unrelated symptoms in one bug | Triage rate-limits - one of the symptoms gets fixed, the bug closes, and the others get lost. | Split into separate bugs; cross-link if related. |
| Severity = Priority shorthand ("Critical = P0") | Confuses intrinsic impact with business prioritization. | Score them independently; let the PM/engineering decide priority. |
Always reproducibility on first observation | The reporter may have triggered a one-off race condition. | Verify "Always" with at least 5 deterministic repros before claiming it. |
References
Severity and priority classification scales
View source (opens in new window)Severity and priority classification scales
Deep reference for the bug-report-template SKILL.md. Consult when filling the Severity and Priority fields in Step 5 - the two are scored independently.
Per ISO/IEC/IEEE 29119-3:2021 (incident-report content; cite by stable standard ID - the spec is paywalled at iso.org but the field semantics are widely adopted).
Severity - intrinsic impact
Severity describes what the defect does to the user when it manifests, independent of business prioritization:
| Severity | When to use |
|---|---|
| Critical | Crash / data loss / security breach / business-stopping outage. |
| Major | Important feature unusable; workaround exists but is significant. |
| Moderate | Degraded UX in a non-critical surface; minor data inconsistency. |
| Minor | Cosmetic, typo, label-only issue. |
Priority - extrinsic business order
Priority describes when the team plans to fix:
| Priority | When to use |
|---|---|
| P0 | Drop everything; fix now; usually paired with Severity Critical. |
| P1 | Fix in the current sprint / cycle. |
| P2 | Fix in the next planning cycle. |
| P3 | Backlog; fix opportunistically. |
The two are independent
A Critical-severity bug for one user might be P2 if the user is non-paying; a Minor-severity bug on the marketing homepage might be P0 if launch is tomorrow. Score severity from the defect's impact on the user; let the PM / engineering decide priority from business context.
Related skills
ci-failure-triage
Decides what kind of failure a red CI test is before anyone starts fixing it. Extracts seven failure signals from the runner output, stack trace, run history, and environment metadata, then walks an ordered first-match-wins rule set to exactly one verdict: flaky-known, environment-drift, defect, timeout, flaky-pre-incident, or flake-of-unknown-cause. Emits the verdict together with the alternatives that were rejected and the specific condition each one failed, so the triage decision is auditable rather than asserted. Use when a test has just gone red and the next action depends on whether the cause is a product defect, a non-deterministic test, or drifted infrastructure.
defect-escape-taxonomy
Classifies a defect that reached production into one of three root gap categories (test gap, process gap, tooling gap) and one of thirteen sub-patterns, applying the earliest-layer rule: the category is the earliest layer that should have caught the defect, expressed as a property of the system and never of a person. Each sub-pattern carries the typical prevention fix, so the finding names an actionable class of gap. Rejects blame language and generic prevention assets such as 'add more tests'. Does not triage or prioritize the defect, does not write the missing test, and does not run a full incident postmortem. Use when a defect has been confirmed in production and the team needs to name which class of gap let it through before deciding what to build.