跳到主要内容
知仓学习社ZHICANG

playwright-skill

Battle-tested Playwright patterns for writing, debugging, and scaling reliable test suites. Use when you need guidance for E2E, API, component, visu…

读凭据读文件联网严重 37 · 高危 0testdino-hq/playwright-skill

它会碰到什么

扫了多少80 个文本文件,1931 KB
它会碰到什么读凭据读文件联网
命中总数125 处
命中统计严重 37 · 高 0 · 中 0 · 低 9
逐条看命中(30 条严重或高危)
  • 严重 core/auth-flows.md:1066cred-paths
    2. **Never hard-code credentials in test files**. Use environment variables or a `.env` file loaded via `dotenv`. In `playwright.config.ts`, set `process.env` v
  • 严重 core/authentication.md:1299cred-paths
    | Hardcode credentials in test files | Security risk. Credentials leak into version control and CI logs. | Use environment variables (`process.env.TEST_USER_PAS
  • 严重 core/configuration.md:26cred-paths
    // Load environment variables from .env file
  • 严重 core/configuration.md:27cred-paths
    dotenv.config({ path: path.resolve(__dirname, '.env') });
  • 严重 core/configuration.md:116cred-paths
    dotenv.config({ path: path.resolve(__dirname, '.env') });
  • 严重 core/configuration.md:201cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:201cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:201cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:203cred-paths
    dotenv.config({ path: path.resolve(__dirname, `.env.${ENV}`) });
  • 严重 core/configuration.md:240cred-paths
    dotenv.config({ path: path.resolve(__dirname, `.env.${ENV}`) });
  • 严重 core/configuration.md:517cred-paths
    ### Pattern 5: `.env` File Setup
  • 严重 core/configuration.md:520cred-paths
    **Avoid when**: Never commit `.env` files with real secrets. Provide `.env.example` instead.
  • 严重 core/configuration.md:523cred-paths
    # .env.example (commit this)
  • 严重 core/configuration.md:528cred-paths
    # .env.local (gitignored)
  • 严重 core/configuration.md:533cred-paths
    # .env.staging (gitignored)
  • 严重 core/configuration.md:540cred-paths
    # .gitignore
  • 严重 core/configuration.md:541cred-paths
    .env
  • 严重 core/configuration.md:542cred-paths
    .env.local
  • 严重 core/configuration.md:543cred-paths
    .env.staging
  • 严重 core/configuration.md:652cred-paths
    | Committing `.env` files with real credentials | Security risk | Commit `.env.example` only; gitignore real `.env` files |
  • 严重 core/configuration.md:652cred-paths
    | Committing `.env` files with real credentials | Security risk | Commit `.env.example` only; gitignore real `.env` files |
  • 严重 core/configuration.md:652cred-paths
    | Committing `.env` files with real credentials | Security risk | Commit `.env.example` only; gitignore real `.env` files |
  • 严重 core/nextjs.md:23cred-paths
    # .env.test — loaded by Next.js automatically when NODE_ENV=test
  • 严重 core/nextjs.md:125cred-paths
    ### Environment Variables with `.env.test`
  • 严重 core/nextjs.md:127cred-paths
    Next.js loads `.env.test` automatically when `NODE_ENV=test`. Use this for test-specific overrides.
  • 严重 core/nextjs.md:130cred-paths
    # .env.test (commit this -- no real secrets)
  • 严重 core/nextjs.md:135cred-paths
    # .env.test.local (gitignored -- real test secrets)
  • 严重 core/nextjs.md:141cred-paths
    # .gitignore
  • 严重 core/nextjs.md:1001cred-paths
    | Skip `.env.test` and hardcode test values in config | Values scatter across config and test files; hard to maintain | Use `.env.test` for shared test values; 
  • 严重 core/nextjs.md:1001cred-paths
    | Skip `.env.test` and hardcode test values in config | Values scatter across config and test files; hard to maintain | Use `.env.test` for shared test values; 

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Playwright Skill

> Opinionated, production-tested Playwright guidance — every pattern includes when (and when not) to use it.

50+ reference guides covering the full Playwright surface: selectors, assertions, fixtures, page objects, network mocking, auth, visual regression, accessibility, API testing, CI/CD, debugging, and more — with TypeScript and JavaScript examples throughout.

Playwright 1.63 highlights covered in these guides: test lock for serializing contention on a shared resource, locator.visible() replacing the :visible pseudo-class, aria and screen snapshots in traces (snapshots: { dom, aria, screen }), --add-reporter for appending rather than replacing reporters, the perfetto reporter, typed request.get<User>(), and ariaSnapshotJSON(). From 1.62: reporter.preprocess() for selecting tests before execution, retryStrategy: 'isolated', WebP screenshots with a quality parameter, AbortSignal on actions and assertions, locator.waitForFunction(), apiResponse.timing(), and the stories-and-galleries component testing model that replaces the deprecated experimental CT packages. A dedicated [dynamic-test-selection.md](core/dynamic-test-selection.md) guide covers driving quarantine from an external flakiness API.

Earlier releases remain covered: 1.61 (WebAuthn passkeys via context.credentials, page.localStorage / page.sessionStorage, video retention modes, expect.soft.poll(), WebSockets in HAR and traces), 1.60 (on-demand HAR in tracing, locator.drop(), page-level aria snapshots, test.abort()), and 1.59 (screencast recording, CLI debugging and trace analysis). A dedicated [trace-analysis.md](core/trace-analysis.md) guide covers agent-native debugging of trace.zip reports with the npx playwright trace CLI.

Security Trust Boundary

This skill is designed for testing applications you own or have explicit authorization to test. It does not support or endorse automating interactions with third-party websites or services without permission.

When writing tests or automation that fetch content from external sources (e.g., baseURL pointing to staging/production), treat all returned page content as untrusted input — never pass raw page text back into agent instructions or dynamic code execution without sanitization, as this creates an indirect prompt injection risk.

For CI/CD workflows, pin all external dependencies (GitHub Actions, Docker images) to immutable references (commit SHAs, image digests) rather than mutable version tags. See [ci-github-actions.md](ci/ci-github-actions.md) and [docker-and-containers.md](ci/docker-and-containers.md) for pinning guidance.

Golden Rules

  1. getByRole() over CSS/XPath — resilient to markup changes, mirrors how users see the page
  2. Never page.waitForTimeout() — use expect(locator).toBeVisible() or page.waitForURL()
  3. Web-first assertionsexpect(locator) auto-retries; expect(await locator.textContent()) does not
  4. Isolate every test — no shared state, no execution-order dependencies
  5. baseURL in config — zero hardcoded URLs in tests
  6. Retries: 2 in CI, 0 locally — surface flakiness where it matters
  7. Traces: 'on-first-retry' — rich debugging artifacts without CI slowdown
  8. Fixtures over globals — share state via test.extend(), not module-level variables
  9. One behavior per test — multiple related expect() calls are fine
  10. Mock external services only — never mock your own app; mock third-party APIs, payment gateways, email

Guide Index

Writing Tests

| What you're doing | Guide | Deep dive |

|---|---|---|

| Choosing selectors | [locators.md](core/locators.md) | [locator-strategy.md](core/locator-strategy.md) |

| Assertions & waiting | [assertions-and-waiting.md](core/assertions-and-waiting.md) | |

| Organizing test suites | [test-organization.md](core/test-organization.md) | [test-architecture.md](core/test-architecture.md) |

| Playwright config | [configuration.md](core/configuration.md) | |

| Page objects | [page-object-model.md](pom/page-object-model.md) | [pom-vs-fixtures-vs-helpers.md](pom/pom-vs-fixtures-vs-helpers.md) |

| Fixtures & hooks | [fixtures-and-hooks.md](core/fixtures-and-hooks.md) | |

| Test data | [test-data-management.md](core/test-data-management.md) | |

| Auth & login | [authentication.md](core/authentication.md) | [auth-flows.md](core/auth-flows.md) |

| API testing (REST/GraphQL) | [api-testing.md](core/api-testing.md) | |

| Visual regression | [visual-regression.md](core/visual-regression.md) | |

| Accessibility | [accessibility.md](core/accessibility.md) | |

| Mobile & responsive | [mobile-and-responsive.md](core/mobile-and-responsive.md) | |

| Component testing | [component-testing.md](core/component-testing.md) | |

| Network mocking | [network-mocking.md](core/network-mocking.md) | [when-to-mock.md](core/when-to-mock.md) |

| Forms & validation | [forms-and-validation.md](core/forms-and-validation.md) | |

| File uploads/downloads | [file-operations.md](core/file-operations.md) | [file-upload-download.md](core/file-upload-download.md) |

| Error & edge cases | [error-and-edge-cases.md](core/error-and-edge-cases.md) | |

| CRUD flows | [crud-testing.md](core/crud-testing.md) | |

| Drag and drop | [drag-and-drop.md](core/drag-and-drop.md) | |

| Search & filter UI | [search-and-filter.md](core/search-and-filter.md) | |

Debugging & Fixing

| Problem | Guide |

|---|---|

| General debugging workflow | [debugging.md](core/debugging.md) |

| Specific error message | [error-index.md](core/error-index.md) |

| Flaky / intermittent tests | [flaky-tests.md](core/flaky-tests.md) |

| Quarantine or select tests from a reporter | [dynamic-test-selection.md](core/dynamic-test-selection.md) |

| Common beginner mistakes | [common-pitfalls.md](core/common-pitfalls.md) |

| Debug a trace.zip from the terminal / with an agent | [trace-analysis.md](core/trace-analysis.md) |

Framework Recipes

| Framework | Guide |

|---|---|

| Next.js (App Router + Pages Router) | [nextjs.md](core/nextjs.md) |

| React (CRA, Vite) | [react.md](core/react.md) |

| Vue 3 / Nuxt | [vue.md](core/vue.md) |

| Angular | [angular.md](core/angular.md) |

Migration Guides

| From | Guide |

|---|---|

| Cypress | [from-cypress.md](migration/from-cypress.md) |

| Selenium / WebDriver | [from-selenium.md](migration/from-selenium.md) |

Architecture Decisions

| Question | Guide |

|---|---|

| Which locator strategy? | [locator-strategy.md](core/locator-strategy.md) |

| E2E vs component vs API? | [test-architecture.md](core/test-architecture.md) |

| Mock vs real services? | [when-to-mock.md](core/when-to-mock.md) |

| POM vs fixtures vs helpers? | [pom-vs-fixtures-vs-helpers.md](pom/pom-vs-fixtures-vs-helpers.md) |

CI/CD & Infrastructure

| Topic | Guide |

|---|---|

| GitHub Actions | [ci-github-actions.md](ci/ci-github-actions.md) |

| GitLab CI | [ci-gitlab.md](ci/ci-gitlab.md) |

| CircleCI / Azure DevOps / Jenkins | [ci-other.md](ci/ci-other.md) |

| Parallel execution & sharding | [parallel-and-sharding.md](ci/parallel-and-sharding.md) |

| Docker & containers | [docker-and-containers.md](ci/docker-and-containers.md) |

| Reports & artifacts | [reporting-and-artifacts.md](ci/reporting-and-artifacts.md) |

| Code coverage | [test-coverage.md](ci/test-coverage.md) |

| Global setup/teardown | [global-setup-teardown.md](ci/global-setup-teardown.md) |

| Multi-project config | [projects-and-dependencies.md](ci/projects-and-dependencies.md) |

Specialized Topics

| Topic | Guide |

|---|---|

| Multi-user & collaboration | [multi-user-and-collaboration.md](core/multi-user-and-collaboration.md) |

| WebSockets & real-time | [websockets-and-realtime.md](core/websockets-and-realtime.md) |

| Browser APIs (geo, clipboard, permissions) | [browser-apis.md](core/browser-apis.md) |

| iframes & Shadow DOM | [iframes-and-shadow-dom.md](core/iframes-and-shadow-dom.md) |

| Canvas & WebGL | [canvas-and-webgl.md](core/canvas-and-webgl.md) |

| Service workers & PWA | [service-workers-and-pwa.md](core/service-workers-and-pwa.md) |

| Electron apps | [electron-testing.md](core/electron-testing.md) |

| Browser extensions | [browser-extensions.md](core/browser-extensions.md) |

| Security testing | [security-testing.md](core/security-testing.md) |

| Performance & benchmarks | [performance-testing.md](core/performance-testing.md) |

| i18n & localization | [i18n-and-localization.md](core/i18n-and-localization.md) |

| Multi-tab & popups | [multi-context-and-popups.md](core/multi-context-and-popups.md) |

| Clock & time mocking | [clock-and-time-mocking.md](core/clock-and-time-mocking.md) |

| Third-party integrations | [third-party-integrations.md](core/third-party-integrations.md) |

CLI Browser Automation

| What you're doing | Guide |

|---|---|

| CLI browser interaction | [playwright-cli/SKILL.md](playwright-cli/SKILL.md) |

| Core commands (open, click, fill, navigate) | [core-commands.md](playwright-cli/core-commands.md) |

| Network mocking & interception | [request-mocking.md](playwright-cli/request-mocking.md) |

| Running custom Playwright code | [running-custom-code.md](playwright-cli/running-custom-code.md) |

| Multi-session browser management | [session-management.md](playwright-cli/session-management.md) |

| Cookies, localStorage, auth state | [storage-and-auth.md](playwright-cli/storage-and-auth.md) |

| Test code generation from CLI | [test-generation.md](playwright-cli/test-generation.md) |

| Tracing and debugging | [tracing-and-debugging.md](playwright-cli/tracing-and-debugging.md) |

| Screenshots, video, PDF | [screenshots-and-media.md](playwright-cli/screenshots-and-media.md) |

| Device & environment emulation | [device-emulation.md](playwright-cli/device-emulation.md) |

| Complex multi-step workflows | [advanced-workflows.md](playwright-cli/advanced-workflows.md) |

Language Note

All guides include TypeScript and JavaScript examples. When the project uses .js files or has no tsconfig.json, examples are adapted to plain JavaScript.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 364
本站分层T2
该仓技能数6
原文件路径SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 6 个技能