Senior Qa

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a normal testing helper, but it can read and write your project files and may install Playwright if you run the setup commands.

Use this in a development repository, preferably on a branch. Review generated tests, Playwright config, auth fixtures, and any CI snippets before committing, pin external tool versions if needed, and keep E2E tests on local or staging environments with test-only accounts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the commands may create or overwrite files in your project and influence test or CI behavior.

Why it was flagged

The skill directs users to run local scripts that scan project files and create test files, which is expected for a QA scaffolding tool but can modify the codebase.

Skill content
python scripts/test_suite_generator.py src/components/ --output __tests__/ ... python scripts/e2e_test_scaffolder.py src/app/ --output e2e/
Recommendation

Run the scripts on a branch or clean working tree, use scoped input/output paths, and review generated diffs before committing.

What this means

If you run this setup command, it can download tooling and change dependencies or configuration in your project.

Why it was flagged

The optional Playwright setup step pulls the latest package initializer, which is purpose-aligned but uses a floating version from the package ecosystem.

Skill content
npm init playwright@latest
Recommendation

Prefer a pinned Playwright version when reproducibility matters, and review package-manager prompts and generated files.

What this means

Using real production accounts or environments in generated E2E tests could expose sessions or mutate real account data.

Why it was flagged

The reference patterns include generated authentication fixtures that log into an app and handle session cookies, which is normal for E2E testing but should be limited to test accounts.

Skill content
await page.request.post('/api/auth/login', { data: { email: testUser.email, password: 'testpassword' } }); ... const cookies = await page.context().cookies();
Recommendation

Use dedicated test users, test passwords, and local or staging environments for generated auth and E2E flows.