Skills alan-test-feature
📦

alan-test-feature

v1.1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Test Features and Publish Evidence Reports

Manual feature testing can miss edge cases and leave evidence scattered. This skill plans browser scenarios, captures results, uploads media, and creates a structured Alan report.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "alan-test-feature" from https://skillstore.io/skills/supatest-ai-alan-test-feature.md and its manifest at https://skillstore.io/api/skills/supatest-ai-alan-test-feature/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/supatest-ai-alan-test-feature.md Signed manifest GET /api/skills/supatest-ai-alan-test-feature/manifest Signed lockfile GET /api/skills/supatest-ai-alan-test-feature/lockfile

Test it

Using "alan-test-feature". Test the new account settings form with standard coverage.

Expected outcome:

A mixed-status report covers saving valid changes, required-field validation, duplicate submission, and server failure. Two reproducible issues include screenshot evidence.

Using "alan-test-feature". Run a light check of the updated checkout confirmation page.

Expected outcome:

A passing report documents navigation, purchase confirmation, persisted order details, and final visual evidence.

Using "alan-test-feature". Test the dashboard comprehensively on desktop and mobile widths.

Expected outcome:

A comprehensive report summarizes responsive layouts, empty states, authorization behavior, navigation, and recoverable API failures with linked media.

Security Audit

High Risk
v1 • 8/20/2026 Open versioned report

Most backtick, localhost, device-file, and reconnaissance alerts are false positives caused by Markdown examples or bounded local testing. Confirmed risks include unpinned global installation, repository script execution, environment-file access, predictable temporary storage, and mandatory capture uploads. Media can contain credentials or private application data and is uploaded without a review gate.

1
Files scanned
440
Lines analyzed
16
Review items
0
False positives ignored

Confirmed security concerns (13)

High
SKILL.md:126
Environment file access
4. Check for `Procfile`, `.env`, `Pipfile`, `requirements.txt`, `Gemfile`
The discovery step includes checking .env while determining how to run the project. It may expose unrelated credentials even though the exact read method is not specified.
High
SKILL.md:162
Environment file access
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
High
SKILL.md:162
Environment variant files
- Check `.env` or `.env.local` for `PORT` or `VITE_PORT` or similar
The skill explicitly directs the agent to inspect .env and .env.local. These files commonly contain credentials beyond the requested port value.
High
SKILL.md:4
Screen capture upload
description: Scope coverage, build a testing strategy, test the feature with agent-browser, capture
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
High
SKILL.md:9
Screen capture upload
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
High
SKILL.md:45
Screen capture upload
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
High
SKILL.md:55
Screen capture upload
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
High
SKILL.md:246
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
Show all 13 confirmed findings
High
SKILL.md:259
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
High
SKILL.md:302
Screen capture upload
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
This mandatory capture is part of the workflow that uploads every screenshot and video to S3. The image may contain credentials, personal data, or private application state.
High
SKILL.md:404
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 — e.g. sandbox-captures/org/task/step-01.png — omit if upload
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
High
SKILL.md:413
Screen capture upload
"screenshotUrl": "<s3Key from Phase 3 showing the issue — omit if upload failed>"
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
High
SKILL.md:426
Screen capture upload
- **screenshotUrls**: flat list of ALL screenshot s3Keys from Phase 3 (for gallery display). Use the
The workflow requires captured application screens to be uploaded and referenced from a persistent report. Sensitive UI data can leave the local environment without a review gate.
Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:9
Ruby/shell backtick execution
Analyze the current branch's changes, scope the coverage level with the user, build an explicit test
The instruction starts project processes and mandates uploading browser captures to S3. These are consequential external actions that can execute repository code and disclose application data.
High
SKILL.md:34-36
Ruby/shell backtick execution
```bash
The fenced command installs an unpinned npm package globally and runs its installer. A compromised or changed package could execute arbitrary code with the agent's permissions.
High
SKILL.md:130-144
Ruby/shell backtick execution
```bash
The command block starts repository-defined npm, Python, Ruby, or Docker services. Those startup paths can execute untrusted project code and alter the local environment.
High
SKILL.md:328
Ruby/shell backtick execution
For each captured file, use the `mcp__alan__get_upload_url` MCP tool to get a presigned S3 URL, then
This instruction explicitly sends every captured file to S3 through a presigned URL. Captures can contain credentials, personal data, or unreleased application details.
High
SKILL.md:350-354
Ruby/shell backtick execution
```bash
The fenced curl command performs the external PUT that uploads a local screenshot. This is a direct data-transfer action with no content review or approval gate.
Medium
SKILL.md:45
Temp directory access
All captures (screenshots, videos) MUST be written to `/tmp/alan-captures/`.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:48
Temp directory access
mkdir -p /tmp/alan-captures
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:52
Temp directory access
> - **ONLY** write capture files to `/tmp/alan-captures/`. Never anywhere else.
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:55
Temp directory access
> - If you are tempted to create a `reports/` or `screenshots/` folder anywhere other than `/tmp/`,
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:236
Temp directory access
agent-browser --session test-feature record start /tmp/alan-captures/happy-path.webm
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:246
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-00-initial-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:259
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/step-NN-description.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:302
Temp directory access
agent-browser --session test-feature screenshot /tmp/alan-captures/final-state.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:313
Temp directory access
for f in /tmp/alan-captures/*.webm; do
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:334
Temp directory access
SIZE=$(stat -c%s "/tmp/alan-captures/step-01.png" 2>/dev/null || stat -f%z "/tmp/alan-captures/step-
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.
Medium
SKILL.md:353
Temp directory access
--data-binary @/tmp/alan-captures/step-01.png
The skill mandates predictable names under a shared /tmp directory without restrictive permissions or symlink checks. Captures may be exposed or redirected on multi-user systems.

Risk Factors

⚙️ External commands (50)
SKILL.md:9 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:23 SKILL.md:27 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-41 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-52 SKILL.md:52-53 SKILL.md:53 SKILL.md:54-55 SKILL.md:55 SKILL.md:65-67 SKILL.md:67-75 SKILL.md:75-81 SKILL.md:81 SKILL.md:109-112 SKILL.md:112-123 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:130-144 SKILL.md:144-149 SKILL.md:149-155 SKILL.md:155-162 SKILL.md:162 SKILL.md:163-164 SKILL.md:164-210 SKILL.md:210-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:226-229 SKILL.md:229-235 SKILL.md:235-237 SKILL.md:237-245 SKILL.md:245-247 SKILL.md:247-254 SKILL.md:254-255 SKILL.md:255 SKILL.md:256 SKILL.md:258-260
🌐 Network access (5)
SKILL.md:152 SKILL.md:163 SKILL.md:221 SKILL.md:227 SKILL.md:347
📁 Filesystem access (19)
SKILL.md:30 SKILL.md:110 SKILL.md:111 SKILL.md:152 SKILL.md:163 SKILL.md:314 SKILL.md:315 SKILL.md:334 SKILL.md:45 SKILL.md:48 SKILL.md:52 SKILL.md:55 SKILL.md:236 SKILL.md:246 SKILL.md:259 SKILL.md:302 SKILL.md:313 SKILL.md:334 SKILL.md:353

Detected Patterns

Screen capture upload×10
Audited by: codex
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/supatest-ai-alan-test-feature/security.svg)](https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/supatest-ai-alan-test-feature?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supatest-ai-alan-test-feature/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/supatest-ai-alan-test-feature.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

supatest-ai. (2026). alan-test-feature security audit report (audit version 1) [Author version 1.1.1]. Skillstore. https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1

BibTeX citation

@techreport{supatest-ai-supatest-ai-alan-test-feature-2026, author = {supatest-ai}, title = {alan-test-feature security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1}, note = {Author version 1.1.1} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "alan-test-feature security audit report (audit version 1)" version: "1.1.1" type: report authors: - name: "supatest-ai" date-released: "2026-08-20" url: "https://skillstore.io/skills/supatest-ai-alan-test-feature/audits/1" identifiers: - type: other value: "skillstore:supatest-ai-alan-test-feature:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
65
Community
91
Spec Compliance

What You Can Build

Validate a Pull Request

Test changed user flows before review and attach visual evidence to a structured report.

Verify Acceptance Criteria

Run agreed scenarios and document passes, failures, and reproducible defects for a feature.

Review a Release Candidate

Check critical workflows, edge cases, responsiveness, and navigation before a release decision.

Try These Prompts

Run a Light Feature Check 
Test the current feature with light coverage. Confirm the main path, capture required evidence, and create the Alan test report.
Run Standard Feature Testing 
Test [feature] with standard coverage. Include the happy path, validation failures, key error states, and a structured report.
Run Comprehensive Browser Testing 
Test [feature] comprehensively. Cover boundaries, permissions, responsiveness, navigation, and recoverable failures. Record separate videos when needed.
Design Risk-Based Change Coverage 
Analyze changes between [base branch] and HEAD. Design risk-based scenarios for [feature], execute them, and report reproducible defects with evidence.

Best Practices

  • Provide acceptance criteria, test accounts, and known risks before execution.
  • Review captures for secrets and personal data before approving uploads.
  • Use stable test data and isolate tests from production systems.

Avoid

  • Do not provide production credentials or unrestricted administrative accounts.
  • Do not upload captures before checking visible data and browser state.
  • Do not treat browser testing as complete security or regression coverage.

Frequently Asked Questions

What coverage levels are supported?
Light covers the main path. Standard adds key edge cases and errors. Comprehensive adds boundaries, responsiveness, navigation, and broader failure states.
Does the skill start the application?
Yes. It inspects common project files, selects a likely development command, starts the server, and checks its local port.
Which browser tool does it use?
It uses the agent-browser command-line tool for navigation, interaction, screenshots, and recording.
Are screenshots and videos required?
The current workflow requires screenshots and attempts video recording. Users should review media before any external upload.
Where is the final report created?
The skill calls the Alan report tool to create a structured artifact linked to the active task, conversation, and team.
Can it test production systems?
The workflow targets a local development server. Production testing requires separate authorization, data controls, and operational safeguards.

Developer Details

License

MIT

Author version

v1.1.1

Skillstore revision

r1

Repository

https://github.com/supatest-ai/alan-skills/tree/e6ebae2c86d4d3ad8597e588f3e820ab0c90658f/skills/alan-test-feature

Ref

bdb71a4bc34515f37772ae85fd5501f9c2ff33b0

Maintenance freshness

8/20/2026

Usage

0 downloads · 0 views

File structure

📄 SKILL.md

More from supatest-ai

View all

Related Skills

View all