技能 playwright-best-practices

📦

playwright-best-practices

Name: playwright-best-practices
Author: currents-dev

v1.2 內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取⚡ 包含腳本🔑 環境變數

Build Reliable Playwright Tests

Fragile tests and inconsistent setup make browser testing difficult to maintain. This skill provides practical Playwright patterns for test design, debugging, and CI workflows.

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "playwright-best-practices" from https://skillstore.io/skills/currents-dev-playwright-best-practices.md and its manifest at https://skillstore.io/api/skills/currents-dev-playwright-best-practices/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/currents-dev-playwright-best-practices.md 已簽名 manifest GET /api/skills/currents-dev-playwright-best-practices/manifest 已簽名 lockfile GET /api/skills/currents-dev-playwright-best-practices/lockfile

測試它

正在使用「playwright-best-practices」。 A checkout test sometimes fails after clicking Submit.

預期結果:

Diagnosis: the assertion runs before the checkout response updates the page.
Recommended change: register the response wait before clicking, then assert the confirmation heading.
Verification: repeat the test and inspect traces for any remaining ordering failures.

正在使用「playwright-best-practices」。 Plan a faster Playwright workflow for our CI pipeline.

預期結果:

Execution plan: divide tests across shards and isolate data by worker.
Dependency plan: align browser binaries with the installed Playwright version and cache them using the dependency lockfile.
Reporting plan: retain failure traces and merge shard reports into one result.
Safety check: verify disposable database targets before reset or restore operations.

安全審計

中風險

v1 • 2026/10/29 開啟版本化報告

Most presented alerts are benign Playwright examples; no evidence found of keylogging, prompt injection, or malicious exfiltration in reviewed context. Confirmed risks involve unguarded database operations, predictable temporary files, and indiscriminate process termination; HAR commit guidance adds a data-disclosure concern. All 400 presented findings were adjudicated; 888 omitted matches still require manual review before automatic publication. Static review was capped at 400/1288 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

已掃描檔案

26,413

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

architecture/when-to-mock.md:160-169 architecture/when-to-mock.md:187-192

HAR Commit Guidance Omits Secret Redaction

The guide says 'Commit `.har` files to version control' after recording staging admin API traffic. Without redaction, recordings can disclose authorization headers, cookies, or sensitive response bodies through repository history.

The recording and commit recommendation are explicit, but no captured HAR was supplied. This confirms unsafe guidance, not an observed credential leak.

能力複核項目 (7)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

core/global-setup.md:163

Database connection strings

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

高

core/configuration.md:266

Synchronous process execution

execSync('npx prisma db push --force-reset', { stdio: 'inherit' });

core/configuration.md:266: Teardown invokes Prisma with --force-reset without validating the database target. An inherited production connection could cause irreversible data loss.

高

core/global-setup.md:163

Synchronous process execution

execSync(`psql $DATABASE_URL < ${SNAPSHOT_PATH}`, { stdio: "inherit" });

core/global-setup.md:163: The snapshot restore executes SQL against DATABASE_URL without verifying a disposable test database. A misconfigured connection can modify a non-test database.

中

debugging/flaky-tests.md:306

Node.js fs operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

debugging/flaky-tests.md:306

Synchronous file operations

fs.writeFileSync(file, "{}");

debugging/flaky-tests.md:306: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

debugging/flaky-tests.md:305

Temp directory access

const file = `/tmp/test-${Date.now()}.json`;

debugging/flaky-tests.md:305: The timestamp-based shared /tmp path is opened with writeFileSync without exclusive creation. Another local user could precreate a symlink and cause file truncation.

中

infrastructure-ci-cd/github-actions.md:519

xargs command (can execute arbitrary commands)

run: lsof -ti:3000 | xargs kill -9 2>/dev/null || true

infrastructure-ci-cd/github-actions.md:519: The command force-kills every process returned for port 3000 without checking ownership by this test run. Shared runners could lose unrelated services.

風險因素

⚙️ 外部命令 (50)

🌐 網路存取 (50)

📁 檔案系統存取 (50)

⚡ 包含腳本 (4)

advanced/authentication.md:467 architecture/pom-vs-fixtures.md:141 core/configuration.md:254 core/configuration.md:265

🔑 環境變數 (50)

advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/authentication.md:108 advanced/authentication.md:109 advanced/authentication.md:201 advanced/authentication.md:206 advanced/authentication.md:211 advanced/authentication.md:443 advanced/authentication.md:491 advanced/authentication.md:492 advanced/authentication.md:627 advanced/authentication.md:628 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 advanced/third-party.md:331 advanced/third-party.md:344 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 architecture/when-to-mock.md:204 architecture/when-to-mock.md:219 architecture/when-to-mock.md:234 architecture/when-to-mock.md:246 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/annotations.md:39 core/annotations.md:53 core/annotations.md:88 core/annotations.md:356 core/annotations.md:366 core/configuration.md:44 core/configuration.md:83 core/configuration.md:84 core/configuration.md:85 core/configuration.md:87 core/configuration.md:95

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/currents-dev-playwright-best-practices/security.svg)](https://skillstore.io/skills/currents-dev-playwright-best-practices?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/currents-dev-playwright-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/currents-dev-playwright-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/currents-dev-playwright-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

currents-dev. (2026). playwright-best-practices security audit report (audit version 1) [Author version 1.2]. Skillstore. https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1

BibTeX 引用

@techreport{currents-dev-currents-dev-playwright-best-practices-2026,
  author = {currents-dev},
  title = {playwright-best-practices security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1},
  note = {Author version 1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "playwright-best-practices security audit report (audit version 1)"
version: "1.2"
type: report
authors:
  - name: "currents-dev"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/currents-dev-playwright-best-practices/audits/1"
identifiers:
  - type: other
    value: "skillstore:currents-dev-playwright-best-practices:audit:1"
    description: "Skillstore immutable audit report identifier"

比較變體

3 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 評分最高

作者 / 來源 Skillstore 評分證據置信度 Skillstore 使用量已更新

0xBigBoss 推薦

0xbigboss-playwright-best-practices

Skillstore 評分 79

證據置信度高

Skillstore 使用量 89

已更新

2026-10-11

currents-dev 目前

currents-dev-playwright-best-practices

Skillstore 評分 50

證據置信度中

Skillstore 使用量未知

已更新

2026-10-29

vitalics

vitalics-playwright-best-practices

Skillstore 評分 38

證據置信度中

Skillstore 使用量 20

已更新

2026-09-09

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Add Maintainable Browser Tests

Create application tests with accessible locators, reusable setup, and assertions tied to visible behavior.

Investigate Intermittent Failures

Review flaky tests for timing errors, shared state, unstable selectors, and missing network synchronization.

Improve CI Test Workflows

Plan browser installation, caching, sharding, reports, and controlled environment setup for automated test runs.

試試這些提示

Write a First Browser Test

Write a Playwright test for the login flow in this project. Use accessible locators and auto-waiting assertions. Identify missing application details before assuming selectors.

Fix a Flaky Test

Review this failing Playwright test and its error output. Identify timing, locator, and isolation problems. Propose focused fixes and repeated-run verification without hiding failures.

Design Authentication Fixtures

Design Playwright fixtures for admin and member workflows in this project. Isolate worker data and protect saved authentication state. Explain which external services need mocks.

Review a Sharded CI Pipeline

Review this Playwright CI configuration for sharding, caching, reports, and database lifecycle. Restrict destructive operations to disposable test resources. Require approval before destructive changes.

最佳實務

Use accessible locators and auto-waiting assertions that describe observable application behavior.
Isolate test data and authentication state; keep credentials and sanitized recordings out of unintended publication paths.
Review destructive setup commands before execution and verify changes with targeted, repeated test runs.

避免

Replacing reliable synchronization with fixed sleeps or excessive retries.
Sharing mutable users, sessions, or database state across parallel workers without isolation.
Running database resets against unverified targets or committing recordings without secret redaction.

常見問題

Does this skill install Playwright or run browsers automatically?

No. It provides guidance and examples. Browser execution requires an available tool environment, installed dependencies, and project configuration.

Can I use it with Claude, Codex, and Claude Code?

The skill declares support for all three tools. Available file access and command execution depend on your configured environment.

Which test types does it cover?

It covers end-to-end, API, component, visual, accessibility, security, and performance testing, with additional Electron and browser extension examples.

Can it help with flaky tests?

Yes. It documents trace analysis, locator improvements, synchronization, test isolation, and repeated runs. Application-specific evidence is still required.

Should every service be mocked?

No. The guidance favors real application integrations and controlled mocks for external services. Select boundaries according to the behavior under test.

Are database cleanup examples safe to copy unchanged?

No. Validate disposable test targets and require approval for destructive operations. Protect credentials, saved sessions, and recorded traffic before sharing artifacts.