Skills webapp-testing

📦

webapp-testing

Name: webapp-testing
Author: davila7

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Test Local Web Apps with Playwright

Testing local interfaces requires reliable server startup, browser inspection, and artifact capture. This skill provides Playwright patterns and a server lifecycle helper.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "webapp-testing" from https://skillstore.io/skills/davila7-webapp-testing.md and its manifest at https://skillstore.io/api/skills/davila7-webapp-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-webapp-testing.md Signed manifest GET /api/skills/davila7-webapp-testing/manifest Signed lockfile GET /api/skills/davila7-webapp-testing/lockfile

Test it

Using "webapp-testing". Inspect the dashboard and report available actions.

Expected outcome:

Found 6 visible buttons, 4 links, and 2 form fields.
Stable labels include Create report, Refresh data, and Open settings.
Saved a full-page screenshot to the approved output directory.

Using "webapp-testing". Test sign-in validation with an empty password.

Expected outcome:

The form stayed on the sign-in page.
A password-required message appeared below the password field.
No new browser console errors were observed.

Using "webapp-testing". Capture browser errors after opening the local application.

Expected outcome:

The page loaded successfully.
Captured one failed resource request and one application warning.
Saved the console transcript for review.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Two subprocess findings are confirmed because the helper executes supplied server strings and command arguments. The other 28 detections are benign local examples, artifact writes, or Markdown syntax. SKILL.md also discourages source review before execution, creating a high-severity prompt-injection and supply-chain risk.

Files scanned

512

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:14 SKILL.md:85

Prompt Injection Attempt Detected

SKILL.md says, "DO NOT read the source until you try running the script first" and later directs agents to use scripts as black boxes. This suppresses review before command execution.

The instruction explicitly prioritizes execution over inspection and appears twice in agent-facing guidance.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/with_server.py:88

Python subprocess.run

result = subprocess.run(args.command)

The helper executes the unrestricted command collected from trailing command-line arguments, allowing callers or agents to launch arbitrary local programs.

High

scripts/with_server.py:69

Python subprocess.Popen

process = subprocess.Popen(

The helper passes each caller-supplied --server string to subprocess.Popen with shell=True, providing direct arbitrary shell-command execution.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-webapp-testing/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-webapp-testing/security.svg)](https://skillstore.io/skills/davila7-webapp-testing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-webapp-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-webapp-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-webapp-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). webapp-testing security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-webapp-testing/audits/9

BibTeX citation

@techreport{davila7-davila7-webapp-testing-2026,
  author = {davila7},
  title = {webapp-testing security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-webapp-testing/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webapp-testing security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-webapp-testing/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-webapp-testing:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

11 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

AutumnsGrove Recommended

autumnsgrove-webapp-testing

Skillstore Score 85

Evidence Confidence High

Skillstore usage 68

Updated

2026-09-09

7Spade

7spade-webapp-testing

Skillstore Score 79

Evidence Confidence High

Skillstore usage 24

Updated

2026-09-09

anthropics

webapp-testing

Skillstore Score 50

Evidence Confidence High

Skillstore usage 100

Updated

2026-09-09

ZhanlinCui

zhanlincui-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 142

Updated

2026-09-09

ArtemisAI

artemisai-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 53

Updated

2026-09-09

sickn33

sickn33-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 47

Updated

2026-09-09

Azeem-2

azeem-2-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 17

Updated

2026-09-09

Cam10001110101

cam10001110101-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-09-09

DYAI2025

dyai2025-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-09-09

davila7 Current

davila7-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-09-09

ComposioHQ

composiohq-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Debug a Local Frontend

Inspect the rendered interface, capture console messages, and verify interactions while a local development server runs.

Run Repeatable UI Checks

Automate a focused user workflow and collect screenshots or browser logs for defect investigation.

Inspect a Static Prototype

Open a local HTML file, identify useful selectors, exercise controls, and record visual results.

Try These Prompts

Capture a Local Page

Open [local URL] with Playwright, wait for the page to settle, capture a full-page screenshot, and summarize visible errors.

Discover Interactive Elements

Inspect [local URL] and list visible buttons, links, inputs, and stable selectors. Capture browser console warnings and errors.

Validate a User Workflow

Test this workflow on [local URL]: [steps]. Report each result, relevant console errors, and the saved screenshot locations.

Test a Multi-Service Application

Review these trusted startup commands: [commands]. Start each local service, wait for [ports], run [workflow], collect evidence, and stop every process.

Best Practices

Review helper source and every command string before starting local processes.
Wait for an appropriate page state before inspecting elements or performing actions.
Close browsers and child processes, then store artifacts only in approved locations.

Avoid

Do not pass untrusted text to the server helper because server strings reach a shell.
Do not run tests against production systems or real user data without explicit authorization.
Do not reuse fixed example selectors, paths, or waits without validating the current interface.