Security audit
Security checks for vulnerabilities and agentic risk
This browser QA skill is not malicious, but it needs review because it tells agents to test forms, login, and checkout flows without clear safeguards for live sites.
Install only if you will use it against sites you own or have permission to test. Before running it, specify a staging or sandbox URL, use test accounts and test payment data, and tell the agent not to submit forms, create accounts, or complete checkout on production unless you explicitly approve that exact action.
The trigger phrases are broad enough to match ordinary requests for testing, UI verification, or QA help, which can cause this skill to activate in situations the user did not explicitly intend. Because the skill encourages browser-driven interaction and screenshots, overbroad activation increases the chance of unintended testing actions against real sites or workflows.
The skill instructs automated interaction testing of forms, authentication, checkout, and other user journeys without warning that these actions may create accounts, submit data, place orders, or affect production systems. In context, this is more dangerous because the workflow explicitly includes login and checkout flows, making unintended state-changing actions likely if the skill is run against live environments.
No suspicious patterns detected.
