Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent E2E testing skill with normal Playwright/Cypress guidance, though users should handle test artifacts as potentially sensitive.
Install only if you want an agent to help with Playwright or Cypress E2E testing. Run tests against staging, mock, or sanitized test data, and review CI artifacts, traces, screenshots, videos, and generated screenshot baselines before sharing or committing them.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-e2e-testing`
- Category: `testing`
- Version: `2.9.0`
- Source: `skills/fec-e2e-testing/SKILL.md`
## Description
This markdown file describes E2E testing of safety-relevant user journeys such as login, payment, permissions, uploads, and real-time communication, and recommends artifacts like screenshots, traces, and videos. However, it does not explicitly warn users that these activities can capture sensitive information or should be limited to safe test environments and sanitized data beyond the brief production restriction.
The manifest description contains very broad trigger language such as creating, maintaining, debugging, or reviewing E2E tests, along with many related keywords. In agent-routing systems, this can cause the skill to activate for a wide range of common testing requests outside its narrow intended use, increasing the chance that its instructions override more appropriate skills or are invoked in unintended contexts.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The guidance recommends uploading Playwright reports, screenshots, videos, and traces as CI artifacts without warning that they can capture sensitive application data such as URLs, tokens in query strings, personal information, account state, and internal environment details. In an E2E-testing skill, this is more dangerous because tests often exercise login, payment, permissions, and other high-sensitivity user journeys, making artifact leakage a realistic exposure path.
The description states that "Chinese triggers include E2E, end-to-end testing, Playwright, Cypress," which introduces a language-specific activation behavior without explaining user choice or opt-in. This can conflict with language/locale policy expectations when a skill implicitly supports or prioritizes a specific language variant without documenting how users select it.
The markdown explains that the first run automatically generates a baseline into the tests/ directory, which is a file-writing side effect. While it is mentioned descriptively, there is no explicit user warning or caution about creating and managing these files, which can affect the workspace and version control state.
No suspicious patterns detected.