Skills route-tester
📦
route-tester
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Test Authenticated Routes Safely
Authenticated route testing can fail when tokens, cookies, and route prefixes are unclear. This skill gives repeatable local patterns for API checks, mock auth, and response validation.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "route-tester" from https://skillstore.io/skills/diet103-route-tester.md and its manifest at https://skillstore.io/api/skills/diet103-route-tester/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "route-tester". Test a protected workflow start route locally.
Expected outcome:
A concise checklist with the full local URL, authentication method, expected status, and database table to verify.
Using "route-tester". A protected endpoint returns 403 during local testing.
Expected outcome:
A troubleshooting sequence covering user role, mock auth headers, route permissions, and service logs.
Using "route-tester". Verify a file upload route after a code change.
Expected outcome:
A local test plan covering token generation, upload request fields, expected response, and storage verification.
Security Audit
High Riskv8 • 7/6/2026 Open versioned report
The skill is documentation-only, but it directs users to run local route-testing commands and modify authentication-related environment settings. Most localhost URL and Markdown backtick detections are false positives, while mock authentication guidance and hardcoded credentials are real risks if reused outside isolated development.
1
Files scanned
389
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
# Add to service .env file (e.g., blog-api/.env)
The skill tells users to add authentication-related values to a service .env file. This is sensitive because it enables mock authentication and changes access-control behavior.
High
Environment file access
### .env (each service)
The .env section provides authentication-related environment values, including MOCK_AUTH and role settings. This configuration is security-sensitive even though it is intended for development.
High
Mock Authentication Bypass Guidance
The skill instructs users to enable MOCK_AUTH and send mock user and role headers, including admin roles. This can bypass real authentication if copied into a shared or production-like environment.
The file explicitly documents mock auth environment variables and headers with admin roles. It states development-only intent, but the instructions can materially weaken authentication if misapplied.
High
Hardcoded Test Credentials and Database Password
The skill documents testuser, testpassword, and a MySQL root password in command examples. Published reusable credentials encourage insecure reuse and can expose local test data.
The credentials are visible in the documented workflow, including a MySQL root password in a runnable command. They appear intended for local testing, but they remain sensitive defaults.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced block directs users or agents to run Docker and MySQL commands against a local database, including privileged credentials. This is expected testing guidance but still carries execution and data-access risk.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
3. Check service is running (`pm2 list`)
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
1. Check service logs (`pm2 logs <service>`)
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Ruby/shell backtick execution
```bash
The referenced block directs users or agents to run Docker and MySQL commands against a local database, including privileged credentials. This is expected testing guidance but still carries execution and data-access risk.
Medium
Ruby/shell backtick execution
```bash
The referenced guidance directs users or agents to run local shell commands such as node, curl, or pm2. This is expected for route testing but still creates command execution risk in an untrusted workspace.
Medium
Hidden file access
# Add to service .env file (e.g., blog-api/.env)
The guide instructs users to edit a hidden .env file to enable mock authentication. Changing hidden auth configuration can weaken security if applied outside isolated development.
Risk Factors
⚙️ External commands (66)
SKILL.md:23 SKILL.md:24 SKILL.md:30 SKILL.md:32 SKILL.md:36-38 SKILL.md:38-42 SKILL.md:42-47 SKILL.md:47-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-72 SKILL.md:72-82 SKILL.md:82-90 SKILL.md:90-95 SKILL.md:95-99 SKILL.md:99-104 SKILL.md:104-109 SKILL.md:109 SKILL.md:110-117 SKILL.md:117-122 SKILL.md:122-126 SKILL.md:126-131 SKILL.md:131-135 SKILL.md:135-140 SKILL.md:140-144 SKILL.md:144-147 SKILL.md:147-151 SKILL.md:151-158 SKILL.md:158-162 SKILL.md:162-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166 SKILL.md:167-168 SKILL.md:168-182 SKILL.md:182-184 SKILL.md:184-188 SKILL.md:188-193 SKILL.md:193-194 SKILL.md:194-195 SKILL.md:195-196 SKILL.md:196-204 SKILL.md:204-216 SKILL.md:216-224 SKILL.md:224-237 SKILL.md:237-245 SKILL.md:245-255 SKILL.md:255-261 SKILL.md:261-271 SKILL.md:271-273 SKILL.md:273-284 SKILL.md:284-310 SKILL.md:310-330 SKILL.md:330-334 SKILL.md:334-349 SKILL.md:349-355 SKILL.md:355-363 SKILL.md:363-367 SKILL.md:367-372 SKILL.md:372-376 SKILL.md:376-377 SKILL.md:377-378 SKILL.md:378-379 SKILL.md:379-380 SKILL.md:380-381
🌐 Network access (26)
SKILL.md:37 SKILL.md:44 SKILL.md:75 SKILL.md:78 SKILL.md:103 SKILL.md:119 SKILL.md:128 SKILL.md:137 SKILL.md:146 SKILL.md:153 SKILL.md:166 SKILL.md:174 SKILL.md:175 SKILL.md:176 SKILL.md:177 SKILL.md:178 SKILL.md:193 SKILL.md:196 SKILL.md:242 SKILL.md:260 SKILL.md:313 SKILL.md:323 SKILL.md:328 SKILL.md:337 SKILL.md:343 SKILL.md:357
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/diet103-route-tester/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/diet103-route-tester?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/diet103-route-tester?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/diet103-route-tester/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/diet103-route-tester.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
diet103. (2026). route-tester security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/diet103-route-tester/audits/8BibTeX citation
@techreport{diet103-diet103-route-tester-2026,
author = {diet103},
title = {route-tester security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/diet103-route-tester/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "route-tester security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "diet103"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/diet103-route-tester/audits/8"
identifiers:
- type: other
value: "skillstore:diet103-route-tester:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Validate a New Endpoint
Test a new authenticated route with expected request data and inspect the response.
Debug Authorization Failures
Compare token, cookie, role, and route prefix settings during local failure investigation.
Confirm Workflow Side Effects
Run route checks and verify expected database records after workflow actions.
Try These Prompts
Find the Test Command
Use the route-tester skill to help me test this local authenticated GET route: [route]. Identify the service port and command pattern.
Test a POST Route
Use the route-tester skill to create a local authenticated POST test for [route] with this request body: [body].
Debug a 401 or 403
Use the route-tester skill to debug why [route] returns [status]. Check cookie format, roles, route prefix, and local auth setup.
Plan End-to-End Route Verification
Use the route-tester skill to plan route tests for [feature]. Include authenticated calls, failure cases, and database verification steps.
Best Practices
- Use mock authentication only in isolated development or test environments.
- Regenerate local test tokens before debugging expired-cookie failures.
- Verify database changes only against local or disposable test data.
Avoid
- Do not copy mock authentication settings into production configuration.
- Do not reuse documented test passwords for shared or deployed services.
- Do not run database commands before confirming the target environment.
Frequently Asked Questions
Does this skill run tests automatically?
No. It provides command patterns and troubleshooting steps for local route testing.
Which authentication style does it assume?
It assumes cookie-based JWT authentication using a refresh token cookie.
Can it help with mock authentication?
Yes. It documents mock auth variables and headers for development and test use.
Is it suitable for production testing?
No. The examples target local services and development-only authentication behavior.
Does it support database verification?
Yes. It includes examples for checking local database records after route changes.
What tools must already exist?
The project must provide the helper script, local services, middleware, and database container.
Developer Details
Author
diet103License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/diet103/claude-code-infrastructure-showcase/tree/main/.claude/skills/route-testerRef
72d5025b022c77f7a51bdf5c1637c689c80e89d1
Maintenance freshness
7/18/2026
Usage
5 downloads · 191 views
File structure
📄 SKILL.md