Skills webapp-testing

📦

webapp-testing

Name: webapp-testing
Author: Azeem-2

Content revision r3 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Test Local Web Applications with Playwright

Local web interfaces can fail in ways that static code review misses. This skill guides Playwright inspection, interaction, screenshots, and console capture.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "webapp-testing" from https://skillstore.io/skills/azeem-2-webapp-testing.md and its manifest at https://skillstore.io/api/skills/azeem-2-webapp-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/azeem-2-webapp-testing.md Signed manifest GET /api/skills/azeem-2-webapp-testing/manifest Signed lockfile GET /api/skills/azeem-2-webapp-testing/lockfile

Test it

Using "webapp-testing". Inspect the local dashboard and report available interactions.

Expected outcome:

The dashboard loaded after network activity settled.
Visible controls included Add project, Search, Settings, and Sign out.
Two links lacked descriptive text and need accessibility review.

Using "webapp-testing". Test the local sign-in flow and capture browser errors.

Expected outcome:

The sign-in form accepted the supplied test account.
Submission remained on the sign-in page instead of opening the dashboard.
The browser console reported one failed authentication request.
A screenshot was captured after the failed submission.

Using "webapp-testing". Verify a static contact form from a local HTML file.

Expected outcome:

The page opened from the local file.
Name and email fields accepted the test values.
The submit action completed without a visible confirmation message.

Security Audit

High Risk

v12 • 7/23/2026 Open versioned report

The helper executes caller-provided server strings through a shell and runs an unrestricted follow-up command. Most SKILL.md backtick alerts are Markdown false positives, but the instructions discourage source inspection before executing the helper.

Files scanned

512

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:14 SKILL.md:85

Prompt Injection Attempt Detected

The instruction says, "DO NOT read the source until you try running the script first" and later recommends using scripts as black boxes. This discourages security inspection before executing community code.

The text explicitly directs the agent to execute code before inspection and to avoid reading the implementation. That behavior can conceal unsafe operations from review.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/with_server.py:88

Python subprocess.run

result = subprocess.run(args.command)

The helper executes the unrestricted trailing command supplied through command-line arguments. Shell parsing is disabled here, but the caller can still select any available executable and arguments.

High

scripts/with_server.py:69

Python subprocess.Popen

process = subprocess.Popen(

The helper passes each caller-provided server string to subprocess.Popen with shell=True. Shell operators in that string can execute arbitrary local commands with the agent process permissions.

Medium

examples/console_logging.py:31

Python file write/append

with open('/mnt/user-data/outputs/console.log', 'w') as f:

The example persists page-controlled console messages to a fixed file and overwrites any existing file there. Console output can contain credentials or other sensitive application data.

Medium

examples/element_discovery.py:37

Temp directory access

page.screenshot(path='/tmp/page_discovery.png', full_page=True)

The example writes a potentially sensitive full-page screenshot to a predictable shared temporary path. This can overwrite an existing file or expose page content to other local processes.

Medium

SKILL.md:69

Temp directory access

page.screenshot(path='/tmp/inspect.png', full_page=True)

The recommended code writes a full-page screenshot to a predictable path in a shared temporary directory. Sensitive page content may be overwritten or exposed through that path.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/azeem-2-webapp-testing/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/azeem-2-webapp-testing/security.svg)](https://skillstore.io/skills/azeem-2-webapp-testing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/azeem-2-webapp-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/azeem-2-webapp-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/azeem-2-webapp-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Azeem-2. (2026). webapp-testing security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/azeem-2-webapp-testing/audits/12

BibTeX citation

@techreport{azeem-2-azeem-2-webapp-testing-2026,
  author = {Azeem-2},
  title = {webapp-testing security audit report (audit version 12)},
  institution = {Skillstore},
  year = {2026},
  number = {12},
  url = {https://skillstore.io/skills/azeem-2-webapp-testing/audits/12},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webapp-testing security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
  - name: "Azeem-2"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/azeem-2-webapp-testing/audits/12"
identifiers:
  - type: other
    value: "skillstore:azeem-2-webapp-testing:audit:12"
    description: "Skillstore immutable audit report identifier"

Compare variants

11 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

AutumnsGrove Recommended

autumnsgrove-webapp-testing

Skillstore Score 85

Evidence Confidence High

Skillstore usage 64

Updated

2026-08-21

7Spade

7spade-webapp-testing

Skillstore Score 79

Evidence Confidence High

Skillstore usage 19

Updated

2026-08-21

anthropics

webapp-testing

Skillstore Score 50

Evidence Confidence High

Skillstore usage 85

Updated

2026-08-21

ZhanlinCui

zhanlincui-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 140

Updated

2026-08-21

ArtemisAI

artemisai-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 49

Updated

2026-08-21

sickn33

sickn33-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 46

Updated

2026-08-21

Azeem-2 Current

azeem-2-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 14

Updated

2026-08-21

Cam10001110101

cam10001110101-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

DYAI2025

dyai2025-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

davila7

davila7-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

ComposioHQ

composiohq-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Verify a Frontend Change

Open a local application, exercise the changed workflow, and capture visible results for review.

Investigate a UI Failure

Inspect rendered elements, browser console messages, and screenshots to identify a failing interaction.

Review a Local Prototype

Run a repeatable browser walkthrough and document the behavior of a static or dynamic prototype.

Try These Prompts

Open and Inspect a Page

Open [local URL] in headless Chromium. Wait for network activity to settle, then list visible buttons, links, and form controls.

Test a User Workflow

Test [workflow] at [local URL]. Perform each step, report failures, and capture a screenshot after the final action.

Diagnose Browser Errors

Reproduce [issue] at [local URL]. Capture browser console messages, note failed interactions, and summarize likely causes with supporting observations.

Coordinate Servers and Regression Checks

Review the bundled helper first. With approval, start [server commands], test [workflows], collect screenshots and console evidence, then verify server cleanup.

Best Practices

Review every community script and the exact command arguments before execution.
Use stable role, label, or identifier selectors and wait for meaningful page states.
Use test accounts and redact secrets from screenshots and console logs.

Avoid

Do not run unreviewed server strings through a shell.
Do not rely only on fixed delays when a page offers observable readiness signals.
Do not store sensitive screenshots or console logs in predictable shared paths.