Webapp Testing

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing...

This skill appears to be what it says: Playwright examples plus a helper to start dev servers. Before installing or running it: 1) Inspect scripts/with_server.py — it spawns user-supplied shell commands (subprocess with shell=True); do not supply untrusted commands. 2) Run the helper with --help and test in an isolated environment (container or VM) so a misbehaving dev server or script can't affect your host. 3) If you plan to allow autonomous agent use, restrict or review any commands the agent can pass to the helper (autonomous invocation + shell-capable helpers increases risk). 4) Check where outputs are written (/mnt/user-data, /tmp) and adjust paths or permissions if needed. 5) If you want stronger safety, run the scripts manually the first time and audit the code (contrary to the SKILL.md suggestion to avoid reading source).

Type: OpenClaw Skill Name: webapp-testing-cn Version: 1.0.0 The skill bundle provides legitimate web testing functionality but contains a shell injection vulnerability in `scripts/with_server.py` due to the use of `subprocess.Popen` with `shell=True` on arbitrary server commands. Furthermore, `SKILL.md` explicitly instructs the AI agent to avoid reading the source code of the scripts ('DO NOT read the source until you try running the script first'), which effectively discourages the agent from auditing the risky implementation or identifying the shell injection surface.