스킬 alan-test-feature
📦
alan-test-feature
v1.1.1 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근
Test Features and Publish Evidence Reports
Manual feature testing can miss edge cases and leave evidence scattered. This skill plans browser scenarios, captures results, uploads media, and creates a structured Alan report.
지원: Claude Codex Code(CC)
설치 전에 중지하고 확인을 요청하세요.
계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "alan-test-feature" from https://skillstore.io/skills/supatest-ai-alan-test-feature.md and its manifest at https://skillstore.io/api/skills/supatest-ai-alan-test-feature/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"alan-test-feature" 사용 중입니다. Test the new account settings form with standard coverage.
예상 결과:
A mixed-status report covers saving valid changes, required-field validation, duplicate submission, and server failure. Two reproducible issues include screenshot evidence.
"alan-test-feature" 사용 중입니다. Run a light check of the updated checkout confirmation page.
예상 결과:
A passing report documents navigation, purchase confirmation, persisted order details, and final visual evidence.
"alan-test-feature" 사용 중입니다. Test the dashboard comprehensively on desktop and mobile widths.
예상 결과:
A comprehensive report summarizes responsive layouts, empty states, authorization behavior, navigation, and recoverable API failures with linked media.
보안 감사
높은 위험v1 • 2026. 8. 20. 버전별 보고서 열기
Most backtick, localhost, device-file, and reconnaissance alerts are false positives caused by Markdown examples or bounded local testing. Confirmed risks include unpinned global installation, repository script execution, environment-file access, predictable temporary storage, and mandatory capture uploads. Media can contain credentials or private application data and is uploaded without a review gate.
1
스캔된 파일
440
분석된 줄 수
16
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (13)
높음
Environment file access
4. Check for `Procfile`, `.env`, `Pipfile`, `requirements.txt`, `Gemfile`
The discovery step includes checking .env while determining how to run the project. It may expose unrelated credentials even though the exact read method is not specified.
높음
Environment file access
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
높음
Environment variant files
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
높음
Screen capture upload
description: Scope coverage, build a testing strategy, test the feature with agent-browser, capture
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
높음
Screen capture upload
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
높음
Screen capture upload
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
높음
Screen capture upload
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
높음
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
확인된 13건 모두 보기
높음
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
높음
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
높음
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 — e.g. sandbox-captures/org/task/step-01.png — omit if upload
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
높음
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 showing the issue — omit if upload failed>"
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
높음
Screen capture upload
- **screenshotUrls**: flat list of ALL screenshot s3Keys from Phase 3 (for gallery display). Use the
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
기능 검토 항목 (16)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
높음
Ruby/shell backtick execution
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The instruction starts project processes and mandates uploading browser captures to S3. These are consequential external actions that can execute repository code and disclose application data.
높음
Ruby/shell backtick execution
```bash
The fenced command installs an unpinned npm package globally and runs its installer. A compromised or changed package could execute arbitrary code with the agent's permissions.
높음
Ruby/shell backtick execution
```bash
The command block starts repository-defined npm, Python, Ruby, or Docker services. Those startup paths can execute untrusted project code and alter the local environment.
높음
Ruby/shell backtick execution
For each captured file, use the `mcp__alan__get_upload_url` MCP tool to get a presigned S3 URL, then
This instruction explicitly sends every captured file to S3 through a presigned URL. Captures can contain credentials, personal data, or unreleased application details.
높음
Ruby/shell backtick execution
```bash
The fenced curl command performs the external PUT that uploads a local screenshot. This is a direct data-transfer action with no content review or approval gate.
중간
Temp directory access
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
mkdir -p /tmp/alan-captures
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
> - **ONLY** write capture files to `/tmp/alan-captures/`. Never anywhere else.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
agent-browser --session test-feature record start /tmp/alan-captures/happy-path.webm
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
for f in /tmp/alan-captures/*.webm; do
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
SIZE=$(stat -c%s "/tmp/alan-captures/step-01.png" 2>/dev/null || stat -f%z "/tmp/alan-captures/step-
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
중간
Temp directory access
--data-binary @/tmp/alan-captures/step-01.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:9 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:23 SKILL.md:27 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-41 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-52 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-55 SKILL.md:55 SKILL.md:65-67 SKILL.md:67-75 SKILL.md:75-81 SKILL.md:81 SKILL.md:109-112 SKILL.md:112-123 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:130-144 SKILL.md:144-149 SKILL.md:149-155 SKILL.md:155-162 SKILL.md:162 SKILL.md:163-164 SKILL.md:164-210 SKILL.md:210-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:226-229 SKILL.md:229-235 SKILL.md:235-237 SKILL.md:237-245 SKILL.md:245-247 SKILL.md:247-254 SKILL.md:254-255 SKILL.md:255 SKILL.md:256 SKILL.md:258-260
🌐 네트워크 접근 (5)
감지된 패턴
Screen capture upload×10
감사자: codex
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supatest-ai-alan-test-feature/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/supatest-ai-alan-test-feature.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
supatest-ai. (2026). alan-test-feature security audit report (audit version 1) [Author version 1.1.1]. Skillstore. https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1BibTeX 인용
@techreport{supatest-ai-supatest-ai-alan-test-feature-2026,
author = {supatest-ai},
title = {alan-test-feature security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1},
note = {Author version 1.1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "alan-test-feature security audit report (audit version 1)"
version: "1.1.1"
type: report
authors:
- name: "supatest-ai"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1"
identifiers:
- type: other
value: "skillstore:supatest-ai-alan-test-feature:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
100
유지보수성
87
콘텐츠
65
커뮤니티
91
사양 준수
만들 수 있는 것
Validate a Pull Request
Test changed user flows before review and attach visual evidence to a structured report.
Verify Acceptance Criteria
Run agreed scenarios and document passes, failures, and reproducible defects for a feature.
Review a Release Candidate
Check critical workflows, edge cases, responsiveness, and navigation before a release decision.
이 프롬프트를 사용해 보세요
Run a Light Feature Check
Test the current feature with light coverage. Confirm the main path, capture required evidence, and create the Alan test report.
Run Standard Feature Testing
Test [feature] with standard coverage. Include the happy path, validation failures, key error states, and a structured report.
Run Comprehensive Browser Testing
Test [feature] comprehensively. Cover boundaries, permissions, responsiveness, navigation, and recoverable failures. Record separate videos when needed.
Design Risk-Based Change Coverage
Analyze changes between [base branch] and HEAD. Design risk-based scenarios for [feature], execute them, and report reproducible defects with evidence.
모범 사례
- Provide acceptance criteria, test accounts, and known risks before execution.
- Review captures for secrets and personal data before approving uploads.
- Use stable test data and isolate tests from production systems.
피하기
- Do not provide production credentials or unrestricted administrative accounts.
- Do not upload captures before checking visible data and browser state.
- Do not treat browser testing as complete security or regression coverage.
자주 묻는 질문
What coverage levels are supported?
Light covers the main path. Standard adds key edge cases and errors. Comprehensive adds boundaries, responsiveness, navigation, and broader failure states.
Does the skill start the application?
Yes. It inspects common project files, selects a likely development command, starts the server, and checks its local port.
Which browser tool does it use?
It uses the agent-browser command-line tool for navigation, interaction, screenshots, and recording.
Are screenshots and videos required?
The current workflow requires screenshots and attempts video recording. Users should review media before any external upload.
Where is the final report created?
The skill calls the Alan report tool to create a structured artifact linked to the active task, conversation, and team.
Can it test production systems?
The workflow targets a local development server. Production testing requires separate authorization, data controls, and operational safeguards.
개발자 세부 정보
작성자
supatest-ai라이선스
MIT
작성자 버전
v1.1.1
Skillstore 리비전
r1
참조
bdb71a4bc34515f37772ae85fd5501f9c2ff33b0
유지보수 최신성
2026. 8. 20.
사용량
0 다운로드 · 1 조회
파일 구조
📄 SKILL.md