Skip to content
Back to skills

Webapp Testing

ASecurity

Toolkit for interacting with and testing local web applications using Playwright. Use when verifying frontend functionality, debugging rendered UI behavior, capturing screenshots, inspecting browser logs, or automating a local web workflow.

  • 2 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 4, 2026
ai-agentspythongobashtestingdebuggingapifrontendbackend

Works with

  • api

Security analysis

A100/100

Pro scans all 6 files and shows the line behind each finding

Scanned September 4, 2026

npx -y skills add paulasilvatech/awesome-harness-primitives --skill webapp-testing --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Webapp Testing?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Webapp Testing
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/paulasilvatech-webapp-testing-4047c5ca/badge)](https://www.skillsdirectory.com/skills/paulasilvatech-webapp-testing-4047c5ca)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: webapp-testing
description: Toolkit for interacting with and testing local web applications using Playwright. Use when verifying frontend functionality, debugging rendered UI behavior, capturing screenshots, inspecting browser logs, or automating a local web workflow.
license: Complete terms in LICENSE.txt
---

# Web Application Testing

## When to invoke

- "Test this local web application with Playwright."
- "Reproduce and diagnose this rendered UI behavior."
- "Capture screenshots, console logs, and interaction evidence for this workflow."

To test local web applications, write native Python Playwright scripts.

**Helper Scripts Available**:
- `scripts/with_server.py` - Manages server lifecycle (supports multiple servers)

**Always run scripts with `--help` first** to see usage. DO NOT read the source until you try running the script first and find that a customized solution is abslutely necessary. These scripts can be very large and thus pollute your context window. They exist to be called directly as black-box scripts rather than ingested into your context window.

## Decision Tree: Choosing Your Approach

```
User task → Is it static HTML?
    ├─ Yes → Read HTML file directly to identify selectors
    │         ├─ Success → Write Playwright script using selectors
    │         └─ Fails/Incomplete → Treat as dynamic (below)
    │
    └─ No (dynamic webapp) → Is the server already running?
        ├─ No → Run: python scripts/with_server.py --help
        │        Then use the helper + write simplified Playwright script
        │
        └─ Yes → Reconnaissance-then-action:
            1. Navigate and wait for networkidle
            2. Take screenshot or inspect DOM
            3. Identify selectors from rendered state
            4. Execute actions with discovered selectors
```

## Example: Using with_server.py

To start a server, run `--help` first, then use the helper:

**Single server:**
```bash
python scripts/with_server.py --server "npm run dev" --port 5173 -- python your_automation.py
```

**Multiple servers (e.g., backend + frontend):**
```bash
python scripts/with_server.py \
  --server "cd backend && python server.py" --port 3000 \
  --server "cd frontend && npm run dev" --port 5173 \
  -- python your_automation.py
```

To create an automation script, include only Playwright logic (servers are managed automatically):
```python
from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True) # Always launch chromium in headless mode
    page = browser.new_page()
    page.goto('http://localhost:5173') # Server already running and ready
    page.wait_for_load_state('networkidle') # CRITICAL: Wait for JS to execute
    # ... your automation logic
    browser.close()
```

## Reconnaissance-Then-Action Pattern

1. **Inspect rendered DOM**:
   ```python
   page.screenshot(path='/tmp/inspect.png', full_page=True)
   content = page.content()
   page.locator('button').all()
   ```

2. **Identify selectors** from inspection results

3. **Execute actions** using discovered selectors

## Common Pitfall

❌ **Don't** inspect the DOM before waiting for `networkidle` on dynamic apps
✅ **Do** wait for `page.wait_for_load_state('networkidle')` before inspection

## Best Practices

- **Use bundled scripts as black boxes** - To accomplish a task, consider whether one of the scripts available in `scripts/` can help. These scripts handle common, complex workflows reliably without cluttering the context window. Use `--help` to see usage, then invoke directly. 
- Use `sync_playwright()` for synchronous scripts
- Always close the browser when done
- Use descriptive selectors: `text=`, `role=`, CSS selectors, or IDs
- Add appropriate waits: `page.wait_for_selector()` or `page.wait_for_timeout()`

## Reference Files

- **examples/** - Examples showing common patterns:
  - `element_discovery.py` - Discovering buttons, links, and inputs on a page
  - `static_html_automation.py` - Using file:// URLs for local HTML
  - `console_logging.py` - Capturing console logs during automation

## Output template

```markdown
## Web application test result

**Status:** passed | failed | blocked
**Target:** <URL or local HTML path>
**Scenario:** <tested user workflow>

### Evidence
- Browser and viewport: <value>
- Screenshots: <paths or none>
- Console errors: <count and summary>
- Failed requests: <count and summary>

### Findings
- <observed behavior with selector or step evidence>

### Validation
- Server lifecycle: <pass, not needed, or blocker>
- Browser cleanup: <pass or blocker>
```

## Quality gate

- [ ] The tested target, scenario, browser, and viewport are explicit.
- [ ] Dynamic pages are inspected only after an appropriate readiness condition.
- [ ] Selectors come from inspected HTML or rendered-state evidence.
- [ ] Screenshots, console output, and request failures are captured when relevant.
- [ ] Credentials, tokens, personal data, and private page content are not leaked in artifacts.
- [ ] The browser and any helper-managed server are closed after the test.
- [ ] Pass, fail, and blocked claims reflect observed behavior rather than expected output.

Files in this skill

  • LICENSE.txt11.1 KB
  • SKILL.md5.1 KB
  • examples/console_logging.py1 KB
  • examples/element_discovery.py1.4 KB
  • examples/static_html_automation.py953 B
  • scripts/with_server.py3.6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…