Skip to content
six-thinking-hats logo

Six Thinking Hats for Testing

six-thinking-hats

Apply Edward de Bono's Six Thinking Hats methodology to software testing for comprehensive quality analysis. Use when designing test strategies, conducting test retrospectives, analyzing test failures, evaluating testing approaches, or facilitating testing discussions. Each hat provides a distinc...

SKILL.md

Full skill instructions

Six Thinking Hats for Testing

<default_to_action> When analyzing testing decisions:

  1. DEFINE focus clearly (specific testing question)
  2. APPLY each hat sequentially (5 min each)
  3. DOCUMENT insights per hat
  4. SYNTHESIZE into action plan

Quick Hat Rotation (30 min):

🤍 WHITE (5 min) - Facts only: metrics, data, coverage
❤️ RED (3 min) - Gut feelings (no justification needed)
🖤 BLACK (7 min) - Risks, gaps, what could go wrong
💛 YELLOW (5 min) - Strengths, opportunities, what works
💚 GREEN (7 min) - Creative ideas, alternatives
🔵 BLUE (3 min) - Action plan, next steps

Example for "API Test Strategy":

  • 🤍 47 endpoints, 30% coverage, 12 integration tests
  • ❤️ Anxious about security, confident on happy paths
  • 🖤 No auth tests, rate limiting untested, edge cases missing
  • 💛 Good docs, CI/​CD integrated, team experienced
  • 💚 Contract testing with Pact, chaos testing, property-based
  • 🔵 Security tests first, contract testing next sprint </​default_to_action>

Quick Reference Card

The Six Hats

HatFocusKey Question
🤍 WhiteFacts & DataWhat do we KNOW?
❤️ RedEmotionsWhat do we FEEL?
🖤 BlackRisksWhat could go WRONG?
💛 YellowBenefitsWhat's GOOD?
💚 GreenCreativityWhat ELSE could we try?
🔵 BlueProcessWhat should we DO?

When to Use Each Hat

HatUse For
🤍 WhiteBaseline metrics, test data inventory
❤️ RedTeam confidence check, quality gut feel
🖤 BlackRisk assessment, gap analysis, pre-mortems
💛 YellowStrengths audit, quick win identification
💚 GreenTest innovation, new approaches, brainstorming
🔵 BlueStrategy planning, retrospectives, decision-making

Hat Details

🤍 White Hat - Facts & Data

Output: Quantitative testing baseline

Questions:

  • What test coverage do we have?
  • What is our pass/​fail rate?
  • What environments exist?
  • What is our defect history?
Example Output:
Coverage: 67% line, 45% branch
Test Suite: 1,247 unit, 156 integration, 23 E2E
Execution Time: Unit 3min, Integration 12min, E2E 45min
Defects: 23 open (5 critical, 8 major, 10 minor)

🖤 Black Hat - Risks & Cautions

Output: Comprehensive risk assessment

Questions:

  • What could go wrong in production?
  • What are we NOT testing?
  • What assumptions might be wrong?
  • Where are the coverage gaps?
HIGH RISKS:
- No load testing (production outage risk)
- Auth edge cases untested (security vulnerability)
- Database failover never tested (data loss risk)

💛 Yellow Hat - Benefits & Optimism

Output: Strengths and opportunities

Questions:

  • What's working well?
  • What strengths can we leverage?
  • What quick wins are available?
STRENGTHS:
- Strong CI/​CD pipeline
- Team expertise in automation
- Stakeholders value quality

QUICK WINS:
- Add smoke tests (reduce incidents)
- Automate manual regression (save 2 days/​release)

💚 Green Hat - Creativity

Output: Innovative testing ideas

Questions:

  • How else could we test this?
  • What if we tried something completely different?
  • What emerging techniques could we adopt?
IDEAS:
1. AI-powered test generation
2. Chaos engineering for resilience
3. Property-based testing for edge cases
4. Production traffic replay
5. Synthetic monitoring

❤️ Red Hat - Emotions

Output: Team gut feelings (NO justification needed)

Questions:

  • How confident do you feel about quality?
  • What makes you anxious?
  • What gives you confidence?
FEELINGS:
- Confident: Unit tests, API tests
- Anxious: Authentication flow, payment processing
- Frustrated: Flaky tests, slow E2E suite

🔵 Blue Hat - Process

Output: Action plan with owners and timelines

Questions:

  • What's our strategy?
  • How should we prioritize?
  • What's the next step?
PRIORITIZED ACTIONS:
1. [Critical] Address security testing gap - Owner: Alice
2. [High] Implement contract testing - Owner: Bob
3. [Medium] Reduce flaky tests - Owner: Carol

Session Templates

Solo Session (30 min)

# Six Hats Analysis: [Topic]

## 🤍 White Hat (5 min)

Facts: [list metrics, data]

## ❤️ Red Hat (3 min)

Feelings: [gut reactions, no justification]

## 🖤 Black Hat (7 min)

Risks: [what could go wrong]

## 💛 Yellow Hat (5 min)

Strengths: [what works, opportunities]

## 💚 Green Hat (7 min)

Ideas: [creative alternatives]

## 🔵 Blue Hat (3 min)

Actions: [prioritized next steps]

Team Session (60 min)

  • Each hat: 10 minutes
  • Rotate through hats as group
  • Document on shared whiteboard
  • Blue Hat synthesizes at end

Agent Integration

// Risk-focused analysis (Black Hat)
const risks = await Task(
  'Identify Risks',
  {
    scope: 'payment-module',
    perspective: 'black-hat',
    includeMitigation: true,
  },
  'qe-regression-risk-analyzer'
);

// Creative test approaches (Green Hat)
const ideas = await Task(
  'Generate Test Ideas',
  {
    feature: 'new-auth-system',
    perspective: 'green-hat',
    includeEmergingTechniques: true,
  },
  'qe-test-generator'
);

// Comprehensive analysis (All Hats)
const analysis = await Task(
  'Six Hats Analysis',
  {
    topic: 'Q1 Test Strategy',
    hats: ['white', 'black', 'yellow', 'green', 'red', 'blue'],
  },
  'qe-quality-analyzer'
);

Agent Coordination Hints

Memory Namespace

aqe/​six-hats/
├── analyses/​*        - Complete hat analyses
├── risks/​*           - Black hat findings
├── opportunities/​*   - Yellow hat findings
└── innovations/​*     - Green hat ideas

Fleet Coordination

const analysisFleet = await FleetManager.coordinate({
  strategy: 'six-hats-analysis',
  agents: [
    'qe-quality-analyzer', // White + Blue hats
    'qe-regression-risk-analyzer', // Black hat
    'qe-test-generator', // Green hat
  ],
  topology: 'parallel',
});

Related Skills


Anti-Patterns

❌ AvoidWhy✅ Instead
Mixing hatsConfuses thinkingOne hat at a time
Justifying Red HatKills intuitionState feelings only
Skipping hatsMisses insightsUse all six
RushingShallow analysis5 min minimum per hat

Remember

Separate thinking modes for clarity. Each hat reveals different insights. Red Hat intuition often catches what Black Hat analysis misses.

Everyone wears all hats. This is parallel thinking, not role-based. The goal is comprehensive analysis, not debate.

More Security skills

supabase logo
Security

supabase

Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...

2.7K 308.9K
View

Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.

98 216.2K
View

Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.

462 163.8K
View

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

462 127.7K
View

Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.

462 125.1K
View

Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.

222 118.2K
View

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

31.9K 116.1K
View
cloudflare logo
Security

cloudflare

Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.

3K 110.7K
View

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

253 103K
View
gws-gmail logo
Security

gws-gmail

Send, read, and manage Gmail messages, drafts, labels, and account settings.

31.2K 78.9K
View

Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.

94 72.3K
View
gws-shared logo
Security

gws-shared

Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.

31.2K 63.4K
View

Security AI tools

StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
GeoSpy logo
Security

GeoSpy

GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams

Free
View

Detect AI-generated voices to protect against audio fraud.

Paid
View

Ensure Your Content's Originality with AI Plagiarism Checker

Freemium
View
Img Upscaler logo
Security

Img Upscaler

Upscale images by 400% without quality loss

Freemium
View
AICheatCheck logo
Security

AICheatCheck

Accurately Detect AI-Generated Content with TheChecker.AI

Free
View
D
Security

Detect GPT

Chrome extension that detects and flags AI-generated content

Free
View