📦
planning-with-files
83Organize Long AI Tasks with Planning Files
Long AI sessions can lose goals, decisions, and progress. This skill guides Claude, Codex, and Claude Code to store plans, findings, and logs in project files.
Productivity View
Skills webapp-testing
📦
webapp-testing
Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands
Test Web Apps with Playwright
Local web apps can be hard to verify after JavaScript renders the page. This skill guides Playwright scripts that inspect UI state, capture screenshots, collect logs, and run against local servers.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "webapp-testing" from https://skillstore.io/skills/zhanlincui-webapp-testing.md and its manifest at https://skillstore.io/api/skills/zhanlincui-webapp-testing/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "webapp-testing". Test my local dashboard and report whether the main navigation works.
Expected outcome:
The report names each navigation item tested, notes visible page changes, and includes the screenshot location for review.
Using "webapp-testing". Capture browser console output while opening the settings page.
Expected outcome:
The result summarizes console errors and warnings, explains likely UI impact, and gives the saved log location.
Using "webapp-testing". Inspect a static HTML form and confirm the submit flow changes the page.
Expected outcome:
The result lists discovered form fields, describes the interaction performed, and references before-and-after screenshots.
Security Audit
High Riskv4 • 7/8/2026 Open versioned report
Most static Markdown and localhost findings are false positives from documentation examples or local debugging artifacts. The helper script does execute user-supplied commands, including shell=True server commands, and the skill text discourages source review before execution.
5
Files scanned
310
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Prompt Injection Attempt Detected
The skill says "DO NOT read the source" and promotes bundled scripts as black boxes before execution, which can suppress review of risky helper code.
The wording directly instructs agents to avoid source inspection before running bundled scripts. The risk is confirmed by the helper using shell=True, but the text may be intended as context management rather than malicious evasion.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
result = subprocess.run(args.command)
The helper executes the trailing command supplied on the CLI. This is intended behavior, but it still enables arbitrary local command execution if unsafe arguments are provided.
High
Python subprocess.Popen
process = subprocess.Popen(
The helper starts user-supplied server commands with shell=True. That creates real shell command execution risk if untrusted command text reaches --server.
Medium
Ruby/shell backtick execution
```bash
The fenced bash example instructs agents to run the helper with an npm server command. It is legitimate usage, but still documents local external command execution.
Medium
Ruby/shell backtick execution
```bash
The fenced bash example includes cd, python, npm, and multiple --server commands. It documents shell-based local server startup that requires trusted inputs.
Risk Factors
🌐 Network access (3)
📁 Filesystem access (4)
⚙️ External commands (23)
scripts/with_server.py:88 scripts/with_server.py:69 SKILL.md:12 SKILL.md:14 SKILL.md:18-33 SKILL.md:33-37 SKILL.md:37-40 SKILL.md:40-42 SKILL.md:42-45 SKILL.md:45-50 SKILL.md:50-53 SKILL.md:53-63 SKILL.md:63-68 SKILL.md:68-72 SKILL.md:72-80 SKILL.md:80-81 SKILL.md:81-85 SKILL.md:85 SKILL.md:86-88 SKILL.md:88 SKILL.md:89 SKILL.md:94-95 SKILL.md:95-96
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/zhanlincui-webapp-testing/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/zhanlincui-webapp-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/zhanlincui-webapp-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zhanlincui-webapp-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/zhanlincui-webapp-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ZhanlinCui. (2026). webapp-testing security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zhanlincui-webapp-testing/audits/4BibTeX citation
@techreport{zhanlincui-zhanlincui-webapp-testing-2026,
author = {ZhanlinCui},
title = {webapp-testing security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/zhanlincui-webapp-testing/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webapp-testing security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "ZhanlinCui"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/zhanlincui-webapp-testing/audits/4"
identifiers:
- type: other
value: "skillstore:zhanlincui-webapp-testing:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
11 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
AutumnsGrove Recommended
autumnsgrove-webapp-testing
Skillstore Score 85
Evidence Confidence High
Skillstore usage 64
Updated
2026-08-21
7spade-webapp-testing
Skillstore Score 79
Evidence Confidence High
Skillstore usage 19
Updated
2026-08-21
webapp-testing
Skillstore Score 50
Evidence Confidence High
Skillstore usage 85
Updated
2026-08-21
ZhanlinCui Current
zhanlincui-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 140
Updated
2026-08-21
artemisai-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 49
Updated
2026-08-21
sickn33-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 46
Updated
2026-08-21
azeem-2-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 14
Updated
2026-08-21
cam10001110101-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated
2026-08-21
dyai2025-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
davila7-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
composiohq-webapp-testing
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
75
Community
91
Spec Compliance
What You Can Build
Verify Local UI Behavior
Run Playwright checks against a local development server and confirm important screens behave as expected.
Debug Rendered Page State
Capture screenshots, console messages, and rendered DOM details after client-side JavaScript finishes loading.
Inspect Static Prototypes
Open local HTML files, interact with visible controls, and capture before-and-after screenshots.
Try These Prompts
Capture a Page Screenshot
Use this skill to open my local web app, wait for the page to finish loading, and capture a full-page screenshot.
Find Interactive Elements
Use this skill to inspect the rendered page and list visible buttons, links, inputs, and useful selectors.
Debug Browser Console Output
Use this skill to run the page, collect browser console messages, and summarize errors or warnings that affect the UI.
Test With Multiple Servers
Use this skill to start the required local servers after confirming the commands, run the Playwright automation, and clean up the servers.
Best Practices
- Review helper scripts and confirm server commands before running local command automation.
- Wait for network idle or visible selectors before inspecting dynamic pages.
- Store screenshots and logs in user-approved workspace output paths.
Avoid
- Running unknown server commands through the helper without reviewing the arguments.
- Inspecting a dynamic page before the application has finished rendering.
- Assuming selectors from static HTML always match the rendered application state.
Frequently Asked Questions
Does this skill require Playwright?
Yes. The examples use Python Playwright with a Chromium browser.
Can it test an app that is already running?
Yes. The skill can guide scripts that connect to an existing local URL.
Can it start local servers?
Yes. The bundled helper can start one or more local servers before running automation.
Are screenshots supported?
Yes. The examples show full-page screenshot capture for rendered pages and static HTML files.
Does it send test data to external services?
No evidence found. The reviewed examples target localhost or local files.
What should I review before using it?
Review any server command and output path, especially when using the helper script.
Developer Details
Author
ZhanlinCuiLicense
Complete terms in LICENSE.txt
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
88a205c7f635a966e31156313b590d59007c5caa
Maintenance freshness
7/18/2026
Usage
137 downloads · 226 views
File structure
More from ZhanlinCui
View all📦
github-release-assistant
83Generate Bilingual GitHub Release READMEs
Release notes and README updates can take time before each GitHub release. This skill generates bilingual release documentation and guides review, commit, and push steps.
Documentation View
📦
obsidian-helper
81Organize Obsidian Notes with AI
Obsidian vaults can become hard to review and update consistently. This skill helps Claude and Codex create daily notes, capture ideas, and summarize recent work.
Productivity View
📦
Process PDFs with Extraction and Form Tools
PDF work often requires separate tools for text, tables, pages, and forms. This skill gives Claude, Codex, and Claude Code guided workflows and helper scripts for PDF tasks.
Office & Reports View
📦
frontend-design
79Build Distinctive Frontend Interfaces
Generic web interfaces can feel unfinished and forgettable. This skill guides Claude, Codex, and Claude Code toward polished frontend work with clear visual direction.
Design & Creative View
📦
brainstorming
79Plan Creative Work Before Building
Teams often start implementation before goals, constraints, and trade-offs are clear. This skill guides Claude, Codex, and Claude Code through structured brainstorming before design work begins.
Productivity View
Related Skills
View all📦
playwright-testing
86Build Reliable Playwright Tests
by C0ntr0lledCha0s
Playwright test suites can become flaky, slow, and difficult to maintain. This skill provides practical patterns for locators, fixtures, page objects, debugging, mocking, and configuration.
Coding & Development View
📦
playwright-best-practices
79Improve Playwright Test Reliability
by 0xBigBoss
Playwright tests often become flaky, slow, and noisy in agent workflows. This skill provides concise patterns for locators, assertions, fixtures, auth reuse, network mocks, and compact reporters.
Coding & Development View
📦
e2e-testing
78Build Reliable Playwright E2E Workflows
by sickn33
End-to-end coverage becomes inconsistent when setup, browser checks, visual tests, and CI integration are planned separately. This skill organizes them into one Playwright workflow.
Coding & Development View
📦
testing
85Build Reliable Test Automation
by 89jobrien
Weak tests slow releases and hide regressions. This skill guides test strategy, TDD, automation, coverage review, and Playwright web checks.
Coding & Development View
📦
firecrawl-build-interact
82Build Firecrawl Browser Interactions
by firecrawl
Dynamic pages often hide data behind clicks, forms, and login flows. This skill helps teams choose and scope Firecrawl /interact integrations.
Coding & Development View
📦
senior-qa
81Improve QA Coverage for Web Apps
by alirezarezvani
Modern teams need clear test strategy and practical automation without slowing delivery. This skill helps Claude, Codex, and Claude Code plan tests, review coverage, and scaffold QA workflows.
Coding & Development View