Skills webapp-testing

📦

webapp-testing

Name: webapp-testing
Author: DYAI2025

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Test Local Web Apps with Playwright

Local web apps can be hard to inspect after JavaScript renders the page. This skill guides Playwright automation for screenshots, selector discovery, console logs, and repeatable UI checks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "webapp-testing" from https://skillstore.io/skills/dyai2025-webapp-testing.md and its manifest at https://skillstore.io/api/skills/dyai2025-webapp-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dyai2025-webapp-testing.md Signed manifest GET /api/skills/dyai2025-webapp-testing/manifest Signed lockfile GET /api/skills/dyai2025-webapp-testing/lockfile

Test it

Using "webapp-testing". Inspect the local dashboard and identify controls needed for a smoke test.

Expected outcome:

A summary of visible navigation, forms, and buttons.
Recommended selectors for important user actions.
A screenshot location and console warning summary.

Using "webapp-testing". Run a checkout flow check on my development server.

Expected outcome:

Server readiness status and browser actions completed.
Failed wait details if the expected screen does not appear.
Cleanup status after the server stops.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Review found mostly false positives from Markdown backticks and localhost example URLs. The helper script still performs real command execution, including shell-based server startup. Fixed output paths and source-review suppression instructions create additional risk.

Files scanned

512

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:14 SKILL.md:85

Prompt Injection Attempt Detected

SKILL.md tells agents, "DO NOT read the source until you try running the script first" and promotes black-box script use. This attempts to suppress source review before command execution.

The text explicitly discourages reading bundled script source before running it. That is a strong prompt-level attempt to reduce inspection of executable files.

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/with_server.py:88

Python subprocess.run

result = subprocess.run(args.command)

The helper executes args.command directly, allowing any command passed after the separator to run on the host. This is real external command execution.

High

scripts/with_server.py:69

Python subprocess.Popen

process = subprocess.Popen(

The helper passes server command strings to subprocess.Popen with shell=True. User-controlled shell strings can execute metacharacters or unintended commands.

Medium

examples/console_logging.py:31

Python file write/append

with open('/mnt/user-data/outputs/console.log', 'w') as f:

The example persists browser console output to a fixed output file. Console logs can contain tokens or private application data.

Medium

examples/element_discovery.py:37

Temp directory access

page.screenshot(path='/tmp/page_discovery.png', full_page=True)

The example writes a full-page screenshot to a predictable temp path. Screenshots can capture sensitive application state on shared systems.

Medium

SKILL.md:69

Temp directory access

page.screenshot(path='/tmp/inspect.png', full_page=True)

The instructions recommend saving a full-page screenshot to a fixed temp path. This can persist sensitive UI data in shared storage.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dyai2025-webapp-testing/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dyai2025-webapp-testing/security.svg)](https://skillstore.io/skills/dyai2025-webapp-testing?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dyai2025-webapp-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dyai2025-webapp-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dyai2025-webapp-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

DYAI2025. (2026). webapp-testing security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dyai2025-webapp-testing/audits/8

BibTeX citation

@techreport{dyai2025-dyai2025-webapp-testing-2026,
  author = {DYAI2025},
  title = {webapp-testing security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dyai2025-webapp-testing/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webapp-testing security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "DYAI2025"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dyai2025-webapp-testing/audits/8"
identifiers:
  - type: other
    value: "skillstore:dyai2025-webapp-testing:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

11 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

AutumnsGrove Recommended

autumnsgrove-webapp-testing

Skillstore Score 85

Evidence Confidence High

Skillstore usage 64

Updated

2026-08-21

7Spade

7spade-webapp-testing

Skillstore Score 79

Evidence Confidence High

Skillstore usage 19

Updated

2026-08-21

anthropics

webapp-testing

Skillstore Score 50

Evidence Confidence High

Skillstore usage 85

Updated

2026-08-21

ZhanlinCui

zhanlincui-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 140

Updated

2026-08-21

ArtemisAI

artemisai-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 49

Updated

2026-08-21

sickn33

sickn33-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 46

Updated

2026-08-21

Azeem-2

azeem-2-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 14

Updated

2026-08-21

Cam10001110101

cam10001110101-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

DYAI2025 Current

dyai2025-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

davila7

davila7-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

ComposioHQ

composiohq-webapp-testing

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Validate Local UI Changes

Verify interactive UI states on a local development server before committing changes.

Collect Bug Evidence

Capture screenshots, console messages, and selector details for reproducible browser bug reports.

Inspect Static Prototypes

Open local HTML prototypes, identify controls, and test simple form interactions.

Try These Prompts

Inspect a Page

Use the webapp-testing skill to open my local app, wait for rendering, list visible buttons, links, and inputs, and report useful selectors.

Capture UI Evidence

Use the skill to capture a full-page screenshot and browser console messages for my local page, then summarize visible errors and warnings.

Run with Server

Use the helper workflow to start my frontend server, wait for the port, run a Playwright check, and stop the server afterward.

Debug Dynamic Flow

Use webapp-testing to inspect a dynamic flow, discover reliable selectors, perform the requested actions, and explain failed waits or missing elements.