Habilidades alan-test-feature
📦
alan-test-feature
v1.1.1 Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos
Test Features and Publish Evidence Reports
Manual feature testing can miss edge cases and leave evidence scattered. This skill plans browser scenarios, captures results, uploads media, and creates a structured Alan report.
Suporta: Claude Codex Code(CC)
Pare e solicite confirmação antes de instalar.
Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "alan-test-feature" from https://skillstore.io/skills/supatest-ai-alan-test-feature.md and its manifest at https://skillstore.io/api/skills/supatest-ai-alan-test-feature/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "alan-test-feature". Test the new account settings form with standard coverage.
Resultado esperado:
A mixed-status report covers saving valid changes, required-field validation, duplicate submission, and server failure. Two reproducible issues include screenshot evidence.
Usando "alan-test-feature". Run a light check of the updated checkout confirmation page.
Resultado esperado:
A passing report documents navigation, purchase confirmation, persisted order details, and final visual evidence.
Usando "alan-test-feature". Test the dashboard comprehensively on desktop and mobile widths.
Resultado esperado:
A comprehensive report summarizes responsive layouts, empty states, authorization behavior, navigation, and recoverable API failures with linked media.
Auditoria de segurança
Risco altov1 • 20/08/2026 Abrir o relatório versionado
Most backtick, localhost, device-file, and reconnaissance alerts are false positives caused by Markdown examples or bounded local testing. Confirmed risks include unpinned global installation, repository script execution, environment-file access, predictable temporary storage, and mandatory capture uploads. Media can contain credentials or private application data and is uploaded without a review gate.
1
Arquivos analisados
440
Linhas analisadas
16
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (13)
Alto
Environment file access
4. Check for `Procfile`, `.env`, `Pipfile`, `requirements.txt`, `Gemfile`
The discovery step includes checking .env while determining how to run the project. It may expose unrelated credentials even though the exact read method is not specified.
Alto
Environment file access
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
Alto
Environment variant files
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
Alto
Screen capture upload
description: Scope coverage, build a testing strategy, test the feature with agent-browser, capture
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Mostrar todos os 13 problemas confirmados
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Alto
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 — e.g. sandbox-captures/org/task/step-01.png — omit if upload
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 showing the issue — omit if upload failed>"
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Alto
Screen capture upload
- **screenshotUrls**: flat list of ALL screenshot s3Keys from Phase 3 (for gallery display). Use the
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Itens de revisão de capacidade (16)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Alto
Ruby/shell backtick execution
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The instruction starts project processes and mandates uploading browser captures to S3. These are consequential external actions that can execute repository code and disclose application data.
Alto
Ruby/shell backtick execution
```bash
The fenced command installs an unpinned npm package globally and runs its installer. A compromised or changed package could execute arbitrary code with the agent's permissions.
Alto
Ruby/shell backtick execution
```bash
The command block starts repository-defined npm, Python, Ruby, or Docker services. Those startup paths can execute untrusted project code and alter the local environment.
Alto
Ruby/shell backtick execution
For each captured file, use the `mcp__alan__get_upload_url` MCP tool to get a presigned S3 URL, then
This instruction explicitly sends every captured file to S3 through a presigned URL. Captures can contain credentials, personal data, or unreleased application details.
Alto
Ruby/shell backtick execution
```bash
The fenced curl command performs the external PUT that uploads a local screenshot. This is a direct data-transfer action with no content review or approval gate.
Médio
Temp directory access
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
mkdir -p /tmp/alan-captures
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
> - **ONLY** write capture files to `/tmp/alan-captures/`. Never anywhere else.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
agent-browser --session test-feature record start /tmp/alan-captures/happy-path.webm
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
for f in /tmp/alan-captures/*.webm; do
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
SIZE=$(stat -c%s "/tmp/alan-captures/step-01.png" 2>/dev/null || stat -f%z "/tmp/alan-captures/step-
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Médio
Temp directory access
--data-binary @/tmp/alan-captures/step-01.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Fatores de risco
⚙️ Comandos externos (50)
SKILL.md:9 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:23 SKILL.md:27 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-41 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-52 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-55 SKILL.md:55 SKILL.md:65-67 SKILL.md:67-75 SKILL.md:75-81 SKILL.md:81 SKILL.md:109-112 SKILL.md:112-123 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:130-144 SKILL.md:144-149 SKILL.md:149-155 SKILL.md:155-162 SKILL.md:162 SKILL.md:163-164 SKILL.md:164-210 SKILL.md:210-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:226-229 SKILL.md:229-235 SKILL.md:235-237 SKILL.md:237-245 SKILL.md:245-247 SKILL.md:247-254 SKILL.md:254-255 SKILL.md:255 SKILL.md:256 SKILL.md:258-260
🌐 Acesso à rede (5)
Padrões detectados
Screen capture upload×10
Auditado por: codex
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supatest-ai-alan-test-feature/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/supatest-ai-alan-test-feature.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
supatest-ai. (2026). alan-test-feature security audit report (audit version 1) [Author version 1.1.1]. Skillstore. https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1Citação BibTeX
@techreport{supatest-ai-supatest-ai-alan-test-feature-2026,
author = {supatest-ai},
title = {alan-test-feature security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1},
note = {Author version 1.1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "alan-test-feature security audit report (audit version 1)"
version: "1.1.1"
type: report
authors:
- name: "supatest-ai"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1"
identifiers:
- type: other
value: "skillstore:supatest-ai-alan-test-feature:audit:1"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Médio 55
Arquitetura
100
Manutenibilidade
87
Conteúdo
65
Comunidade
91
Conformidade com a especificação
O que você pode criar
Validate a Pull Request
Test changed user flows before review and attach visual evidence to a structured report.
Verify Acceptance Criteria
Run agreed scenarios and document passes, failures, and reproducible defects for a feature.
Review a Release Candidate
Check critical workflows, edge cases, responsiveness, and navigation before a release decision.
Teste estes prompts
Run a Light Feature Check
Test the current feature with light coverage. Confirm the main path, capture required evidence, and create the Alan test report.
Run Standard Feature Testing
Test [feature] with standard coverage. Include the happy path, validation failures, key error states, and a structured report.
Run Comprehensive Browser Testing
Test [feature] comprehensively. Cover boundaries, permissions, responsiveness, navigation, and recoverable failures. Record separate videos when needed.
Design Risk-Based Change Coverage
Analyze changes between [base branch] and HEAD. Design risk-based scenarios for [feature], execute them, and report reproducible defects with evidence.
Boas práticas
- Provide acceptance criteria, test accounts, and known risks before execution.
- Review captures for secrets and personal data before approving uploads.
- Use stable test data and isolate tests from production systems.
Evitar
- Do not provide production credentials or unrestricted administrative accounts.
- Do not upload captures before checking visible data and browser state.
- Do not treat browser testing as complete security or regression coverage.
Perguntas frequentes
What coverage levels are supported?
Light covers the main path. Standard adds key edge cases and errors. Comprehensive adds boundaries, responsiveness, navigation, and broader failure states.
Does the skill start the application?
Yes. It inspects common project files, selects a likely development command, starts the server, and checks its local port.
Which browser tool does it use?
It uses the agent-browser command-line tool for navigation, interaction, screenshots, and recording.
Are screenshots and videos required?
The current workflow requires screenshots and attempts video recording. Users should review media before any external upload.
Where is the final report created?
The skill calls the Alan report tool to create a structured artifact linked to the active task, conversation, and team.
Can it test production systems?
The workflow targets a local development server. Production testing requires separate authorization, data controls, and operational safeguards.
Detalhes do desenvolvedor
Autor
supatest-aiLicença
MIT
Versão do autor
v1.1.1
Revisão da Skillstore
r1
Referência
bdb71a4bc34515f37772ae85fd5501f9c2ff33b0
Atualidade da manutenção
20/08/2026
Uso
0 downloads · 1 visualizações
Estrutura de arquivos
📄 SKILL.md