qa-role-security
Application-security & compliance QA role bundle: one-command install of unified security scanning (SAST, DAST, SCA, secrets, SBOM), fuzzing, compliance, multi-tenancy isolation, test-data privacy, and IaC policy testing.
Install this role bundle
/plugin install qa-role-security@testland-qaOne command installs all 6 member plugins. Requires Claude Code v2.1.110+ (v2.1.143+ to enable the whole set together). Role bundles install through Claude Code only: the skills.sh CLI installs skills, and a bundle owns none of its own.
Application security & compliance QA
Application-security & compliance QA role bundle: one-command install of unified security scanning (SAST, DAST, SCA, secrets, SBOM), fuzzing, compliance, multi-tenancy isolation, test-data privacy, and IaC policy testing.
Installing this one plugin installs all 6 member plugins below in a single command.
Install
/plugin marketplace add testland/qa
/plugin install qa-role-security@testland-qaClaude Code resolves and installs the member plugins automatically and lists what it added. Requires Claude Code v2.1.110+ (v2.1.143+ to enable the whole set together).
What this installs
About role bundles
This is a role bundle - a plugin that ships no skills or agents of its own. It exists only to install a curated set of testing plugins together so you adopt a whole role in one command instead of installing each plugin by hand. Prefer a narrower set? Install just the member plugins you need individually.
Installs these 6 plugins
qa-security-scanning
Unified security scanning across five domains - SAST (semgrep-rules, sonarqube-rules, codeql-queries, language-native-sast, multi-tool-finding-triage), DAST (zap-baseline, nuclei-dast), SCA (snyk-test, osv-scanner, dependabot-config, renovate-config, npm-pip-maven-audit, reachability-analyzer, cve-exploitability-triage), secrets (gitleaks-scanning, trufflehog-scanning, secrets-rotation-runner), and SBOM + container (syft-generation, sbom-formats, trivy-image, vex-author): 21 skills and 1 agent (security-finding-triager), the cross-domain adversarial unifier that gates multi-scanner output into one BLOCK / PASS verdict per domain. Every scanner skill includes a mandatory False-positive triage section.
qa-fuzz-testing
Structure-aware coverage-guided fuzzing: 3 reference skills (corpus-management-reference, sanitiser-integration-reference, crash-triage-reference) + 7 per-language fuzzer skills (libfuzzer-cpp, afl-plus-plus, go-native-fuzzing, cargo-fuzz-rust, atheris-python-fuzzing, jazzer-jvm-fuzzing, ossfuzz-integration) + 1 dispatcher skill (fuzz-tool-selector) + 2 agents (fuzz-target-author, fuzz-findings-critic). Distinct from qa-property-based (hypothesis-driven + shrinking) and qa-api-testing/schemathesis-fuzzing (API-layer); this is binary/system-level coverage-guided fuzzing.
qa-compliance
Compliance test patterns + readiness review: 8 skills (audit-trail-test-author, ccpa-test-patterns, compliance-evidence-generator, gdpr-test-patterns, hipaa-test-patterns, iso27001-test-patterns, pci-dss-control-test-author, soc2-evidence-collector) and 1 agent (compliance-readiness-reviewer). Covers regulated-industry test pattern catalogs.
qa-multi-tenancy
Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.
qa-test-data-privacy
PII detection, masking, and synthetic data generation for test environments: 8 skills (data-masking-techniques-reference, faker-synthetic-data, k-anonymity-verifier, pii-categories-reference, pii-masking-pipeline-builder, presidio-pii-detection, synthea-healthcare-data, test-data-governance-reference) and 1 agent (pii-leak-critic).
qa-iac
Infrastructure-as-code testing + security policy: 4 skills (helm-chart-tester, policy-as-code-runner, checkov-policy, trivy-config - the tfsec successor, with the legacy tfsec workflow in its references) and 1 agent (terraform-plan-reviewer). Cross-scanner IaC finding triage is handled by security-finding-triager in the qa-security-scanning plugin.