スキル playwright-best-practices

📦

playwright-best-practices

Name: playwright-best-practices
Author: currents-dev

v1.2 コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス⚡ スクリプトを含む🔑 環境変数

Build Reliable Playwright Tests

Fragile tests and inconsistent setup make browser testing difficult to maintain. This skill provides practical Playwright patterns for test design, debugging, and CI workflows.

対応: Claude Codex Code(CC)

⚠️ 50 不十分

Maintain this Skill? Claim it ⚠️ 50 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "playwright-best-practices" from https://skillstore.io/skills/currents-dev-playwright-best-practices.md and its manifest at https://skillstore.io/api/skills/currents-dev-playwright-best-practices/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/currents-dev-playwright-best-practices.md 署名済み manifest GET /api/skills/currents-dev-playwright-best-practices/manifest 署名済み lockfile GET /api/skills/currents-dev-playwright-best-practices/lockfile

テストする

「playwright-best-practices」を使用しています。 A checkout test sometimes fails after clicking Submit.

期待される結果:

Diagnosis: the assertion runs before the checkout response updates the page.
Recommended change: register the response wait before clicking, then assert the confirmation heading.
Verification: repeat the test and inspect traces for any remaining ordering failures.

「playwright-best-practices」を使用しています。 Plan a faster Playwright workflow for our CI pipeline.

期待される結果:

Execution plan: divide tests across shards and isolate data by worker.
Dependency plan: align browser binaries with the installed Playwright version and cache them using the dependency lockfile.
Reporting plan: retain failure traces and merge shard reports into one result.
Safety check: verify disposable database targets before reset or restore operations.

セキュリティ監査

中リスク

v1 • 2026/10/29 バージョン別レポートを開く

Most presented alerts are benign Playwright examples; no evidence found of keylogging, prompt injection, or malicious exfiltration in reviewed context. Confirmed risks involve unguarded database operations, predictable temporary files, and indiscriminate process termination; HAR commit guidance adds a data-disclosure concern. All 400 presented findings were adjudicated; 888 omitted matches still require manual review before automatic publication. Static review was capped at 400/1288 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

スキャンされたファイル

26,413

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中

architecture/when-to-mock.md:160-169 architecture/when-to-mock.md:187-192

HAR Commit Guidance Omits Secret Redaction

The guide says 'Commit `.har` files to version control' after recording staging admin API traffic. Without redaction, recordings can disclose authorization headers, cookies, or sensitive response bodies through repository history.

The recording and commit recommendation are explicit, but no captured HAR was supplied. This confirms unsafe guidance, not an observed credential leak.

機能レビュー項目 (7)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

core/global-setup.md:163

Database connection strings

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

高

core/configuration.md:266

Synchronous process execution

execSync('npx prisma db push --force-reset', { stdio: 'inherit' });

core/configuration.md:266: Teardown invokes Prisma with --force-reset without validating the database target. An inherited production connection could cause irreversible data loss.

高

core/global-setup.md:163

Synchronous process execution

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

中

debugging/flaky-tests.md:306

Node.js fs operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

debugging/flaky-tests.md:306

Synchronous file operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

debugging/flaky-tests.md:305

Temp directory access

const file = `/tmp/test-${Date.now()}.json`;

debugging/flaky-tests.md:305: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

infrastructure-ci-cd/github-actions.md:519

xargs command (can execute arbitrary commands)

run: lsof -ti:3000 | xargs kill -9 2>/dev/null || true

infrastructure-ci-cd/github-actions.md:519: The command force-kills every process returned for port 3000 without checking ownership by this test run. Shared runners could lose unrelated services.

リスク要因

⚙️ 外部コマンド (50)

🌐 ネットワークアクセス (50)

📁 ファイルシステムへのアクセス (50)

⚡ スクリプトを含む (4)

advanced/authentication.md:467 architecture/pom-vs-fixtures.md:141 core/configuration.md:254 core/configuration.md:265

🔑 環境変数 (50)

advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/configuration.md:44 core/configuration.md:83 core/configuration.md:84 core/configuration.md:85 core/configuration.md:87 core/configuration.md:95

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/currents-dev-playwright-best-practices/security.svg)](https://skillstore.io/skills/currents-dev-playwright-best-practices?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/currents-dev-playwright-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/currents-dev-playwright-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/currents-dev-playwright-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

currents-dev. (2026). playwright-best-practices security audit report (audit version 1) [Author version 1.2]. Skillstore. https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1

BibTeX形式の引用

@techreport{currents-dev-currents-dev-playwright-best-practices-2026,
  author = {currents-dev},
  title = {playwright-best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1},
  note = {Author version 1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "playwright-best-practices security audit report (audit version 1)"
version: "1.2"
type: report
authors:
  - name: "currents-dev"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:currents-dev-playwright-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

バリアントを比較

インストール可能なバリアント 3 件

各作者のスキルは個別のインストール項目として維持されます。推奨バリアントは Skillstore の証拠で順位付けされます。

このバリアントが首位の理由

Skillstore スコアが最高

作者 / ソース Skillstore スコア証拠の信頼度 Skillstore 利用状況更新済み

0xBigBoss 推奨

0xbigboss-playwright-best-practices

Skillstore スコア 79

証拠の信頼度高

Skillstore 利用状況 91

更新済み

2026-10-11

currents-dev 現在

currents-dev-playwright-best-practices

Skillstore スコア 50

証拠の信頼度中

Skillstore 利用状況 2

更新済み

2026-10-29

vitalics

vitalics-playwright-best-practices

Skillstore スコア 38

証拠の信頼度中

Skillstore 利用状況 20

更新済み

2026-09-09

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Add Maintainable Browser Tests

Create application tests with accessible locators, reusable setup, and assertions tied to visible behavior.

Investigate Intermittent Failures

Review flaky tests for timing errors, shared state, unstable selectors, and missing network synchronization.

Improve CI Test Workflows

Plan browser installation, caching, sharding, reports, and controlled environment setup for automated test runs.

これらのプロンプトを試す

Write a First Browser Test

Write a Playwright test for the login flow in this project. Use accessible locators and auto-waiting assertions. Identify missing application details before assuming selectors.

Fix a Flaky Test

Review this failing Playwright test and its error output. Identify timing, locator, and isolation problems. Propose focused fixes and repeated-run verification without hiding failures.

Design Authentication Fixtures

Design Playwright fixtures for admin and member workflows in this project. Isolate worker data and protect saved authentication state. Explain which external services need mocks.

Review a Sharded CI Pipeline

Review this Playwright CI configuration for sharding, caching, reports, and database lifecycle. Restrict destructive operations to disposable test resources. Require approval before destructive changes.

ベストプラクティス

Use accessible locators and auto-waiting assertions that describe observable application behavior.
Isolate test data and authentication state; keep credentials and sanitized recordings out of unintended publication paths.
Review destructive setup commands before execution and verify changes with targeted, repeated test runs.

回避

Replacing reliable synchronization with fixed sleeps or excessive retries.
Sharing mutable users, sessions, or database state across parallel workers without isolation.
Running database resets against unverified targets or committing recordings without secret redaction.

よくある質問

Does this skill install Playwright or run browsers automatically?

No. It provides guidance and examples. Browser execution requires an available tool environment, installed dependencies, and project configuration.

Can I use it with Claude, Codex, and Claude Code?

The skill declares support for all three tools. Available file access and command execution depend on your configured environment.

Which test types does it cover?

It covers end-to-end, API, component, visual, accessibility, security, and performance testing, with additional Electron and browser extension examples.

Can it help with flaky tests?

Yes. It documents trace analysis, locator improvements, synchronization, test isolation, and repeated runs. Application-specific evidence is still required.

Should every service be mocked?

No. The guidance favors real application integrations and controlled mocks for external services. Select boundaries according to the behavior under test.

Are database cleanup examples safe to copy unchanged?

No. Validate disposable test targets and require approval for destructive operations. Protect credentials, saved sessions, and recorded traffic before sharing artifacts.