Habilidades playwright-best-practices Historial de auditorías

📦

Historial de auditorías

playwright-best-practices - 1 auditoría

29 oct 2026, 14:53

Most presented alerts are benign Playwright examples; no evidence found of keylogging, prompt injection, or malicious exfiltration in reviewed context. Confirmed risks involve unguarded database operations, predictable temporary files, and indiscriminate process termination; HAR commit guidance adds a data-disclosure concern. All 400 presented findings were adjudicated; 888 omitted matches still require manual review before automatic publication. Static review was capped at 400/1288 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Archivos escaneados

26,413

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

architecture/when-to-mock.md:160-169 architecture/when-to-mock.md:187-192

HAR Commit Guidance Omits Secret Redaction

The guide says 'Commit `.har` files to version control' after recording staging admin API traffic. Without redaction, recordings can disclose authorization headers, cookies, or sensitive response bodies through repository history.

The recording and commit recommendation are explicit, but no captured HAR was supplied. This confirms unsafe guidance, not an observed credential leak.

Elementos de revisión de capacidades (7)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

core/global-setup.md:163

Database connection strings

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

Alto

core/configuration.md:266

Synchronous process execution

execSync('npx prisma db push --force-reset', { stdio: 'inherit' });

core/configuration.md:266: Teardown invokes Prisma with --force-reset without validating the database target. An inherited production connection could cause irreversible data loss.

Alto

core/global-setup.md:163

Synchronous process execution

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

Medio

debugging/flaky-tests.md:306

Node.js fs operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Medio

debugging/flaky-tests.md:306

Synchronous file operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Medio

debugging/flaky-tests.md:305

Temp directory access

const file = `/tmp/test-${Date.now()}.json`;

debugging/flaky-tests.md:305: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

Medio

infrastructure-ci-cd/github-actions.md:519

xargs command (can execute arbitrary commands)

run: lsof -ti:3000 | xargs kill -9 2>/dev/null || true

infrastructure-ci-cd/github-actions.md:519: The command force-kills every process returned for port 3000 without checking ownership by this test run. Shared runners could lose unrelated services.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (50)

📁 Acceso al sistema de archivos (50)

⚡ Contiene scripts (4)

advanced/authentication.md:467 architecture/pom-vs-fixtures.md:141 core/configuration.md:254 core/configuration.md:265

🔑 Variables de entorno (50)

advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/configuration.md:44 core/configuration.md:83 core/configuration.md:84 core/configuration.md:85 core/configuration.md:87 core/configuration.md:95

Auditado por: codex

← Volver a la habilidad