Habilidades alan-test-feature
📦
alan-test-feature
v1.1.1 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos
Test Features and Publish Evidence Reports
Manual feature testing can miss edge cases and leave evidence scattered. This skill plans browser scenarios, captures results, uploads media, and creates a structured Alan report.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "alan-test-feature" from https://skillstore.io/skills/supatest-ai-alan-test-feature.md and its manifest at https://skillstore.io/api/skills/supatest-ai-alan-test-feature/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "alan-test-feature". Test the new account settings form with standard coverage.
Resultado esperado:
A mixed-status report covers saving valid changes, required-field validation, duplicate submission, and server failure. Two reproducible issues include screenshot evidence.
Usando "alan-test-feature". Run a light check of the updated checkout confirmation page.
Resultado esperado:
A passing report documents navigation, purchase confirmation, persisted order details, and final visual evidence.
Usando "alan-test-feature". Test the dashboard comprehensively on desktop and mobile widths.
Resultado esperado:
A comprehensive report summarizes responsive layouts, empty states, authorization behavior, navigation, and recoverable API failures with linked media.
Auditoría de seguridad
Riesgo altov1 • 20/8/2026 Abrir el informe versionado
Most backtick, localhost, device-file, and reconnaissance alerts are false positives caused by Markdown examples or bounded local testing. Confirmed risks include unpinned global installation, repository script execution, environment-file access, predictable temporary storage, and mandatory capture uploads. Media can contain credentials or private application data and is uploaded without a review gate.
1
Archivos escaneados
440
Líneas analizadas
16
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (13)
Alto
Environment file access
4. Check for `Procfile`, `.env`, `Pipfile`, `requirements.txt`, `Gemfile`
The discovery step includes checking .env while determining how to run the project. It may expose unrelated credentials even though the exact read method is not specified.
Alto
Environment file access
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
Alto
Environment variant files
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
Alto
Screen capture upload
description: Scope coverage, build a testing strategy, test the feature with agent-browser, capture
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Mostrar los 13 problemas confirmados
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 — e.g. sandbox-captures/org/task/step-01.png — omit if upload
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 showing the issue — omit if upload failed>"
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
- **screenshotUrls**: flat list of ALL screenshot s3Keys from Phase 3 (for gallery display). Use the
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Elementos de revisión de capacidades (16)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Ruby/shell backtick execution
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The instruction starts project processes and mandates uploading browser captures to S3. These are consequential external actions that can execute repository code and disclose application data.
Alto
Ruby/shell backtick execution
```bash
The fenced command installs an unpinned npm package globally and runs its installer. A compromised or changed package could execute arbitrary code with the agent's permissions.
Alto
Ruby/shell backtick execution
```bash
The command block starts repository-defined npm, Python, Ruby, or Docker services. Those startup paths can execute untrusted project code and alter the local environment.
Alto
Ruby/shell backtick execution
For each captured file, use the `mcp__alan__get_upload_url` MCP tool to get a presigned S3 URL, then
This instruction explicitly sends every captured file to S3 through a presigned URL. Captures can contain credentials, personal data, or unreleased application details.
Alto
Ruby/shell backtick execution
```bash
The fenced curl command performs the external PUT that uploads a local screenshot. This is a direct data-transfer action with no content review or approval gate.
Medio
Temp directory access
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
mkdir -p /tmp/alan-captures
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
> - **ONLY** write capture files to `/tmp/alan-captures/`. Never anywhere else.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
agent-browser --session test-feature record start /tmp/alan-captures/happy-path.webm
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
for f in /tmp/alan-captures/*.webm; do
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
SIZE=$(stat -c%s "/tmp/alan-captures/step-01.png" 2>/dev/null || stat -f%z "/tmp/alan-captures/step-
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medio
Temp directory access
--data-binary @/tmp/alan-captures/step-01.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Factores de riesgo
⚙️ Comandos externos (50)
SKILL.md:9 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:23 SKILL.md:27 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-41 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-52 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-55 SKILL.md:55 SKILL.md:65-67 SKILL.md:67-75 SKILL.md:75-81 SKILL.md:81 SKILL.md:109-112 SKILL.md:112-123 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:130-144 SKILL.md:144-149 SKILL.md:149-155 SKILL.md:155-162 SKILL.md:162 SKILL.md:163-164 SKILL.md:164-210 SKILL.md:210-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:226-229 SKILL.md:229-235 SKILL.md:235-237 SKILL.md:237-245 SKILL.md:245-247 SKILL.md:247-254 SKILL.md:254-255 SKILL.md:255 SKILL.md:256 SKILL.md:258-260
🌐 Acceso a red (5)
Patrones detectados
Screen capture upload×10
Auditado por: codex
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supatest-ai-alan-test-feature/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/supatest-ai-alan-test-feature.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
supatest-ai. (2026). alan-test-feature security audit report (audit version 1) [Author version 1.1.1]. Skillstore. https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1Cita BibTeX
@techreport{supatest-ai-supatest-ai-alan-test-feature-2026,
author = {supatest-ai},
title = {alan-test-feature security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1},
note = {Author version 1.1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "alan-test-feature security audit report (audit version 1)"
version: "1.1.1"
type: report
authors:
- name: "supatest-ai"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1"
identifiers:
- type: other
value: "skillstore:supatest-ai-alan-test-feature:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 55
Arquitectura
100
Mantenibilidad
87
Contenido
65
Comunidad
91
Cumplimiento de la especificación
Lo que puedes crear
Validate a Pull Request
Test changed user flows before review and attach visual evidence to a structured report.
Verify Acceptance Criteria
Run agreed scenarios and document passes, failures, and reproducible defects for a feature.
Review a Release Candidate
Check critical workflows, edge cases, responsiveness, and navigation before a release decision.
Prueba estos prompts
Run a Light Feature Check
Test the current feature with light coverage. Confirm the main path, capture required evidence, and create the Alan test report.
Run Standard Feature Testing
Test [feature] with standard coverage. Include the happy path, validation failures, key error states, and a structured report.
Run Comprehensive Browser Testing
Test [feature] comprehensively. Cover boundaries, permissions, responsiveness, navigation, and recoverable failures. Record separate videos when needed.
Design Risk-Based Change Coverage
Analyze changes between [base branch] and HEAD. Design risk-based scenarios for [feature], execute them, and report reproducible defects with evidence.
Mejores prácticas
- Provide acceptance criteria, test accounts, and known risks before execution.
- Review captures for secrets and personal data before approving uploads.
- Use stable test data and isolate tests from production systems.
Evitar
- Do not provide production credentials or unrestricted administrative accounts.
- Do not upload captures before checking visible data and browser state.
- Do not treat browser testing as complete security or regression coverage.
Preguntas frecuentes
What coverage levels are supported?
Light covers the main path. Standard adds key edge cases and errors. Comprehensive adds boundaries, responsiveness, navigation, and broader failure states.
Does the skill start the application?
Yes. It inspects common project files, selects a likely development command, starts the server, and checks its local port.
Which browser tool does it use?
It uses the agent-browser command-line tool for navigation, interaction, screenshots, and recording.
Are screenshots and videos required?
The current workflow requires screenshots and attempts video recording. Users should review media before any external upload.
Where is the final report created?
The skill calls the Alan report tool to create a structured artifact linked to the active task, conversation, and team.
Can it test production systems?
The workflow targets a local development server. Production testing requires separate authorization, data controls, and operational safeguards.
Detalles del desarrollador
Autor
supatest-aiLicencia
MIT
Versión del autor
v1.1.1
Revisión de Skillstore
r1
Ref.
bdb71a4bc34515f37772ae85fd5501f9c2ff33b0
Actualidad del mantenimiento
20/8/2026
Uso
0 descargas · 1 vistas
Estructura de archivos
📄 SKILL.md