Website Usability Testing using Nova Act

AI-orchestrated usability testing using Amazon Nova Act. The agent generates personas, runs tests to collect raw data, interprets responses to determine goal achievement, and generates HTML reports. Tests real user workflows (booking, checkout, posting) with safety guardrails. Use when asked to "test website usability", "run usability test", "generate usability report", "evaluate user experience", "test checkout flow", "test booking process", or "analyze website UX".

This skill is coherent for Nova Act–driven usability testing, but follow these precautions before using it: - Only run tests against non-production or isolated test environments (the tool records full HTML and screenshots and may capture PII). - Keep your Nova Act API key in ~/.openclaw/config/nova-act.json and treat it as a secret; do not check it into source control. Rotate the key if you suspect exposure. - Review safe_nova_wrapper and test-run the scripts locally to confirm the 'STOP before payment/posting/account creation' guardrails behave as you expect — the agent is still responsible for interpretation and could accidentally trigger final actions if mis-instructed. - Clean up or securely store the ./nova_act_logs/ and generated trace/report files after use (they contain page content and screenshots). Consider running inside a VM/container when testing untrusted sites. - Install dependencies from official sources (pip, Playwright) and verify package names match documentation (nova-act, pydantic, playwright). - Run a small dry-run on a benign site to validate behavior (trace locations, partial-report handling) before testing sensitive workflows. If you want more confidence, request a short audit of the safe_nova_wrapper and any code that decides when to stop before final actions; that will reduce the chance of accidental material effects.

Type: OpenClaw Skill Name: website-usability-test-nova-act Version: 1.0.3 The skill is designed for AI-orchestrated web usability testing using Amazon Nova Act. It includes robust safety features like explicit 'safety stops' before material impact actions (e.g., payment, posting) in `scripts/dynamic_exploration.py` and `scripts/run_adaptive_test.py`, and clear warnings about sensitive data in trace files in `SKILL.md`. However, the core functionality involves navigating to and interacting with arbitrary, user-provided URLs via `scripts/run_adaptive_test.py`. While the skill itself does not exhibit malicious intent (e.g., no data exfiltration, no unauthorized persistence), the inherent risk of a browser automation tool interacting with untrusted external websites, combined with the use of `subprocess.run` in `SKILL.md` to execute internal scripts (which could be a shell injection vulnerability if the orchestrating agent does not sanitize user-provided URLs before passing them as arguments), classifies it as 'suspicious' rather than 'benign'.