Skip to content
skillsafebeta
← Report library
Purpose / Browser automation

E2e Testing Patterns Skill Security Audit

What the author says it does (original text)

Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.

Independent security check

Security risks found

Files checked
2
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Unpinned npx and npm examples may fetch and run whichever package version resolves at the time

Source references: 2
What we found

The Skill recommends invoking npx playwright directly and shows an npm install command without a version. Without a locked local dependency, the package manager may resolve, download, and execute package code available from the configured registry at that time.

Why this matters

If the registry, name resolution, or latest package release is compromised, install scripts or test tooling can run with the user's permissions and access the test workspace and its environment variables.

These are manual documentation examples and are not automatically executed by the Skill. However, both npx commands omit a version; if Playwright is absent locally and npx permits automatic fetching, it may download and run the package resolved from the configured registry. The npm install example also leaves `@axe-core/playwright` unpinned, so results can vary with resolution time, registry, and lockfile and may invoke dependency install scripts. The user can require a lockfile, exact versions, and a trusted registry.

SKILL.md:101In the instructionsOpen original file
```typescript// Playwright debugging// 1. Run in headed modenpx playwright test --headed// 2. Run in debug modenpx playwright test --debug
Show 1 other places
references/details.md:389In the instructionsOpen original file
### Pattern 3: Accessibility Testing```typescript// Install: npm install @axe-core/playwrightimport { test, expect } from "@playwright/test";import AxeBuilder from "@axe-core/playwright";
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Failure artifacts may retain login details, session content, or personal data

Source references: 4
What we found

The configuration retains traces, screenshots, and videos on retries or failures, and the debugging example writes media files directly. E2E tests also enter email addresses and passwords into browser pages, so those artifacts can capture sensitive page state.

Why this matters

Credentials, session tokens, account data, or personal information shown in the UI could be disclosed if CI artifacts, reports, or workspace files are accessible to unintended people.

The reference configuration records a trace on the first retry and retains screenshots and video on failures; another debugging example writes screenshot and video files directly. The login example fills an email and password into browser fields, so artifacts created during authentication or authenticated pages may contain credential fields, session content, or personal data. Actual exposure depends on the tested pages and artifact permissions. The user can require sensitive-field masking, short retention, and restricted CI artifact access.

references/details.md:21In the instructionsOpen original file
  workers: process.env.CI ? 1 : undefined,  reporter: [["html"], ["junit", { outputFile: "results.xml" }]],  use: {    baseURL: "http://localhost:3000",    trace: "on-first-retry",    screenshot: "only-on-failure",    video: "retain-on-failure",  },
Show 3 other places
references/details.md:62In the instructionsOpen original file
  async login(email: string, password: string) {    await this.emailInput.fill(email);    await this.passwordInput.fill(password);    await this.loginButton.click();  }
SKILL.md:108In the instructionsOpen original file
// 3. Use trace viewerawait page.screenshot({ path: 'screenshot.png' });await page.video()?.saveAs('video.webm');
references/details.md:24In the instructionsOpen original file
    baseURL: "http://localhost:3000",    trace: "on-first-retry",    screenshot: "only-on-failure",    video: "retain-on-failure",  },
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

An example forwards an ordinary API request after changing its role to administrator

Source references: 2
What we found

The reference does more than mock a response: it intercepts a users API request, sets role to admin, and forwards the modified request with route.continue. Although presented as a test example, copied code would alter the actual outgoing request.

Why this matters

If the test is accidentally connected to a shared, staging, or production backend that wrongly trusts client-supplied roles, it could create or modify a privileged account and affect permissions or data integrity.

This is a test example under network mocking and interception, not hidden behavior automatically executed by the Skill. However, if copied and run, it intercepts matching `/api/users` requests, changes `role` to `admin`, and forwards the modified request through `route.continue`. Against a real or privileged backend, this could create or alter administrator data without proper authorization. The user can require an isolated test environment, mocked backend, low-privilege accounts, and verification that server-side authorization remains enforced.

references/details.md:203In the instructionsOpen original file
// Intercept and modify requeststest("can modify API request", async ({ page }) => {  await page.route("**/api/users", async (route) => {    const request = route.request();    const postData = JSON.parse(request.postData() || "{}");    // Modify request    postData.role = "admin";    await route.continue({      postData: JSON.stringify(postData),    });  });
Show 1 other places
references/details.md:186In the instructionsOpen original file
### Pattern 4: Network Mocking and Interception```typescript// Mock API responsestest("displays error when API fails", async ({ page }) => {  await page.route("**/api/users", (route) => {
Low risk

The install command does not pin a dependency version

Source references: 4
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

What this evidence establishes

This is a manual debugging example for running Playwright tests, not an explicit installation command, and the Skill does not automatically execute it. If Playwright is installed and locked, npx normally uses the local version; otherwise, fetching a package depends on the npx/npm version, configuration, and confirmation behavior. This line alone does not establish an unpinned installation. The user can require a lockfile, a local package script, or an explicit version and disable automatic npx installation.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
What this evidence establishes

This line is a manual npx command for starting debug mode, not an explicit dependency-installation step. It may run a locally installed, locked Playwright version; resolution and download of an unspecified version are possible only if the package is absent and the current npx configuration permits fetching it. Thus there is a conditional supply-chain risk, but the source does not directly establish that this is an installation command. The user can require use of only the locked local binary.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:103In the instructionsOpen original file
// 1. Run in headed modenpx playwright test --headed
Show 3 other places
SKILL.md:101In the instructionsOpen original file
```typescript// Playwright debugging// 1. Run in headed modenpx playwright test --headed
SKILL.md:106In the instructionsOpen original file
// 2. Run in debug modenpx playwright test --debug
SKILL.md:105In the instructionsOpen original file
// 2. Run in debug modenpx playwright test --debug
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

This Skill is guidance for Playwright and Cypress end-to-end testing; its main file directs the agent to a reference containing configuration, fixtures, network interception, and accessibility examples.

View source
SKILL.md:62In the instructionsOpen original file
## Detailed patterns and worked examplesDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.

The examples create and delete a database test user and expose an administrator password from an environment variable through a test fixture. The implementations of the create and delete functions are not included in the supplied files.

View source
references/details.md:114In the instructionsOpen original file
export const test = base.extend<TestData>({  testUser: async ({}, use) => {    const user = {      email: `test-${Date.now()}@example.com`,      password: "Test123!@#",      name: "Test User",    };    // Setup: Create user in database    await createTestUser(user);    await use(user);    // Teardown: Clean up user    await deleteTestUser(user.email);  },
references/details.md:128In the instructionsOpen original file
  adminUser: async ({}, use) => {    await use({      email: "admin@example.com",      password: process.env.ADMIN_PASSWORD!,    });  },

The Playwright configuration defaults to a local site and produces traces, screenshots, and videos on retries or failures; the debugging example also explicitly saves screenshots and videos.

View source
references/details.md:21In the instructionsOpen original file
  workers: process.env.CI ? 1 : undefined,  reporter: [["html"], ["junit", { outputFile: "results.xml" }]],  use: {    baseURL: "http://localhost:3000",    trace: "on-first-retry",    screenshot: "only-on-failure",    video: "retain-on-failure",  },
SKILL.md:108In the instructionsOpen original file
// 3. Use trace viewerawait page.screenshot({ path: 'screenshot.png' });await page.video()?.saveAs('video.webm');

The network-interception examples include both fully mocked responses and modification of a request before forwarding it to the target application; one example changes the requested role to administrator.

View source
references/details.md:203In the instructionsOpen original file
// Intercept and modify requeststest("can modify API request", async ({ page }) => {  await page.route("**/api/users", async (route) => {    const request = route.request();    const postData = JSON.parse(request.postData() || "{}");    // Modify request    postData.role = "admin";    await route.continue({      postData: JSON.stringify(postData),    });  });
Start here · InstructionsSKILL.md
e2e-testing-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:64In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
Install extra software packages
SKILL.md:103In the instructionsOpen original file
// 1. Run in headed modenpx playwright test --headed
SKILL.md:106In the instructionsOpen original file
// 2. Run in debug modenpx playwright test --debug
references/details.md:385In the instructionsOpen original file
// Run in CI// npx playwright test --shard=1/4// npx playwright test --shard=2/4
Read keys or account settings
references/details.md:18In the instructionsOpen original file
  fullyParallel: true,  forbidOnly: !!process.env.CI,  retries: process.env.CI ? 2 : 0,
references/details.md:19In the instructionsOpen original file
  forbidOnly: !!process.env.CI,  retries: process.env.CI ? 2 : 0,  workers: process.env.CI ? 1 : undefined,
references/details.md:20In the instructionsOpen original file
  retries: process.env.CI ? 2 : 0,  workers: process.env.CI ? 1 : undefined,  reporter: [["html"], ["junit", { outputFile: "results.xml" }]],
Connect to websites
references/details.md:23In the instructionsOpen original file
  use: {    baseURL: "http://localhost:3000",    trace: "on-first-retry",
references/details.md:246In the instructionsOpen original file
  e2e: {    baseUrl: "http://localhost:3000",    viewportWidth: 1280,
Lines read
542
File checksum (to compare versions)
dc201a9e2c11ba69da637add5dfe0c79958e656150d36401277415949df960c9