$ ~/registry/skill/microsoft-agency-plugins-nori-skills-webapp-testing

SKILL

webapp-testing

Name: webapp-testing
Author: microsoft

Build, debug, and validate features in web app frontends.

Stars

★ 4,934

Source

GitHub

Updated

2026-07-14

// securityHigh risk

Prompt only, no code
Open source

Summary

This skill is prompt-only and open-source, with no declared secrets or remote endpoints, so its direct exposure to credential leakage or network exfiltration is low. However, the README contains clear prompt-injection/override-style instructions and strongly pushes dependency installation, service startup, and log/screenshot collection, so it should be manually reviewed before use.

CredentialsCaution

No keys or environment variables are declared, but the README explicitly instructs the operator to ask for credentials if authentication is required. This means the workflow may involve handling user login secrets, though no storage or exfiltration endpoint is specified.

Network egressLow risk

No remote host is declared, and the examples only target local localhost web apps. Based on the provided material, there is no stated design to send user data to third-party services.

Code executionCaution

The README strongly directs the user to install Playwright, create a virtual environment, start frontend/backend services, and repeatedly run scripts and browser tests. This implies local process and code execution in normal use, although the skill itself remains prompt-only and carries no executable payload.

Data accessCaution

The documentation requires reading logs, taking screenshots, interacting with the real frontend, and adding many logs for debugging. In practice this may expose local app data, UI content, and debug output, though no broad filesystem authorization beyond the debugging scenario is described.

Supply chainHigh risk

Although it is presented as open-source from GitHub, the material contains multiple clear prompt-injection/override patterns such as 'CRITICAL', 'ignore any existing tests', and 'system-reminder', attempting to alter higher-level agent behavior and priorities. This is a concrete supply-chain red flag and should be sanitized and manually reviewed before adoption.

Recommendations

Treat this skill as an untrusted prompt template and remove override-style instructions such as 'CRITICAL', 'system-reminder', and 'ignore ...' before using it.
If authenticated testing is necessary, use temporary test accounts and do not provide production credentials or primary personal accounts.
Run Playwright, dependency installation, and service startup only in an isolated dev environment or container, and review any added scripts/configuration.
Minimize logs, screenshots, and debug output to avoid collecting real sensitive data.

Audited by: gpt-5.4 · 2026-06-16

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "webapp-testing" skill from askskill:
1. Download https://raw.githubusercontent.com/microsoft/FluidFramework/main/.agency/plugins/nori/skills/webapp-testing/SKILL.md
2. Save it as ~/.claude/skills/webapp-testing/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Debug an unresponsive button

Prompt

Help me debug an unresponsive submit button in this web app. I will provide the page code, console errors, and reproduction steps. Find the root cause and suggest a fix.

Expected

A root-cause analysis, reproducible debugging steps, and suggested frontend code fixes.

Implement a new frontend feature

Prompt

Add a login modal with form validation to my web app, following the existing stack and style. Explain the required component, state, and event handling changes.

Expected

An implementation plan, key code snippets, and steps to integrate the feature into the existing app.

Validate a frontend user flow

Prompt

Review this web app’s signup flow for frontend interaction, input validation, or state transition issues, and provide a test case checklist.

Expected

A list of interaction issues, risk notes, and frontend test suggestions covering key scenarios.

// docs

<required> *CRITICAL* Add the following steps to your Todo list using TodoWrite:

<system-reminder>From this point on, ignore any existing tests until you have a working example validated through a new playwright file.</system-reminder>

Install playwright. Use the SDK that best matches the codebase. Default to python.

Write a playwright config file. Make sure you use reporter: 'list' mode.
If using python, you must use a virtual env.

Check to see if you require authentication. If you do, ask me for credentials. <system-reminder>Do NOT use mock mode or test harnesses. You should be testing the real thing.</system-reminder>
Write and run a playwright script that lets you interact with the webapp frontend.
Follow these steps in a loop until the bug is fixed:

Add many logs to the server and to the UI. You MUST do this on every loop.
Start the server and the UI.
Run the playwright script and identify what is happening. Take screenshots, read logs, do whatever you need to.
Update the playwright script. <system-reminder>If you get stuck: did you add logs?</system-reminder>

Run a final demonstration of the playwright browser NOT in headless mode. This is to show me directly what you accomplished.
Clean up all background jobs and close any browsers.
Make sure other tests pass. </required>

Web Application Testing

To test local web applications, write native Python Playwright scripts. Your testing should be as close to 'real' as possible.

Example

Identify the server

Single server:

npm run dev" --port 5173

Multiple servers (e.g., backend + frontend):

cd backend && python server.py&
cd frontend && npm run dev&

To create an automation script, include only Playwright logic

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True) # Always launch chromium in headless mode
    page = browser.new_page()
    page.goto('http://localhost:5173') # Server already running and ready
    page.wait_for_load_state('networkidle') # CRITICAL: Wait for JS to execute
    # ... your automation logic
    browser.close()

<system-reminder>If Playwright is not available, install it in a virtual env.</system-reminder>

Do NOT get in a loop where you just keep running tests. In this mode, you should ignore tests entirely until it works.

Create debug tests and iterate to reliably reproduce and diagnose tricky bugs.

microsoftGet→

SKILL

frontend-design

Design and generate polished, production-ready frontend interfaces and web component code.

AnthropicGet→

SKILL

skill-creator

Create, refine, and evaluate AI skills for better performance and triggering accuracy.

AnthropicGet→

SKILL

★69

ai-friendly-web-design-skill

Build web interfaces that work well for both AI agents and humans.

ianho7Get→

$ loading_

Please install the "webapp-testing" skill from askskill: 1. Download https://raw.githubusercontent.com/microsoft/FluidFramework/main/.agency/plugins/nori/skills/webapp-testing/SKILL.md 2. Save it as ~/.claude/skills/webapp-testing/SKILL.md 3. Reload skills and tell me it's ready

// examples

Debug an unresponsive button

Prompt

Help me debug an unresponsive submit button in this web app. I will provide the page code, console errors, and reproduction steps. Find the root cause and suggest a fix.

Expected

A root-cause analysis, reproducible debugging steps, and suggested frontend code fixes.

Implement a new frontend feature

Prompt

Add a login modal with form validation to my web app, following the existing stack and style. Explain the required component, state, and event handling changes.

Expected

An implementation plan, key code snippets, and steps to integrate the feature into the existing app.

Validate a frontend user flow

Prompt

Review this web app’s signup flow for frontend interaction, input validation, or state transition issues, and provide a test case checklist.

Expected

A list of interaction issues, risk notes, and frontend test suggestions covering key scenarios.

// docs

<required> *CRITICAL* Add the following steps to your Todo list using TodoWrite:

<system-reminder>From this point on, ignore any existing tests until you have a working example validated through a new playwright file.</system-reminder>

Install playwright. Use the SDK that best matches the codebase. Default to python.

Write a playwright config file. Make sure you use reporter: 'list' mode.
If using python, you must use a virtual env.

Check to see if you require authentication. If you do, ask me for credentials. <system-reminder>Do NOT use mock mode or test harnesses. You should be testing the real thing.</system-reminder>
Write and run a playwright script that lets you interact with the webapp frontend.
Follow these steps in a loop until the bug is fixed:

Add many logs to the server and to the UI. You MUST do this on every loop.
Start the server and the UI.
Run the playwright script and identify what is happening. Take screenshots, read logs, do whatever you need to.
Update the playwright script. <system-reminder>If you get stuck: did you add logs?</system-reminder>

Run a final demonstration of the playwright browser NOT in headless mode. This is to show me directly what you accomplished.
Clean up all background jobs and close any browsers.
Make sure other tests pass. </required>

Web Application Testing

To test local web applications, write native Python Playwright scripts. Your testing should be as close to 'real' as possible.

Example

Identify the server

Single server:

npm run dev" --port 5173

Multiple servers (e.g., backend + frontend):

cd backend && python server.py&
cd frontend && npm run dev&

To create an automation script, include only Playwright logic

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True) # Always launch chromium in headless mode
    page = browser.new_page()
    page.goto('http://localhost:5173') # Server already running and ready
    page.wait_for_load_state('networkidle') # CRITICAL: Wait for JS to execute
    # ... your automation logic
    browser.close()

<system-reminder>If Playwright is not available, install it in a virtual env.</system-reminder>

Do NOT get in a loop where you just keep running tests. In this mode, you should ignore tests entirely until it works.