跳到主要内容
知仓学习社ZHICANG

playwright-skill

Battle-tested Playwright patterns for E2E, API, component, visual, accessibility, and security testing. Covers locators, fixtures, POM, network mock…

读凭据读文件联网严重 37 · 高危 0zebbern/claude-code-guide

它会碰到什么

扫了多少76 个文本文件,1929 KB
它会碰到什么读凭据读文件联网
命中总数121 处
命中统计严重 37 · 高 0 · 中 0 · 低 9
逐条看命中(30 条严重或高危)
  • 严重 core/auth-flows.md:1027cred-paths
    2. **Never hard-code credentials in test files**. Use environment variables or a `.env` file loaded via `dotenv`. In `playwright.config.ts`, set `process.env` v
  • 严重 core/authentication.md:1296cred-paths
    | Hardcode credentials in test files                                        | Security risk. Credentials leak into version control and CI logs.                 
  • 严重 core/configuration.md:26cred-paths
    // Load environment variables from .env file
  • 严重 core/configuration.md:27cred-paths
    dotenv.config({ path: path.resolve(__dirname, ".env") })
  • 严重 core/configuration.md:114cred-paths
    dotenv.config({ path: path.resolve(__dirname, ".env") })
  • 严重 core/configuration.md:199cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:199cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:199cred-paths
    // Load environment-specific .env file: .env.staging, .env.production, etc.
  • 严重 core/configuration.md:201cred-paths
    dotenv.config({ path: path.resolve(__dirname, `.env.${ENV}`) })
  • 严重 core/configuration.md:238cred-paths
    dotenv.config({ path: path.resolve(__dirname, `.env.${ENV}`) })
  • 严重 core/configuration.md:513cred-paths
    ### Pattern 5: `.env` File Setup
  • 严重 core/configuration.md:516cred-paths
    **Avoid when**: Never commit `.env` files with real secrets. Provide `.env.example` instead.
  • 严重 core/configuration.md:519cred-paths
    # .env.example (commit this)
  • 严重 core/configuration.md:524cred-paths
    # .env.local (gitignored)
  • 严重 core/configuration.md:529cred-paths
    # .env.staging (gitignored)
  • 严重 core/configuration.md:536cred-paths
    # .gitignore
  • 严重 core/configuration.md:537cred-paths
    .env
  • 严重 core/configuration.md:538cred-paths
    .env.local
  • 严重 core/configuration.md:539cred-paths
    .env.staging
  • 严重 core/configuration.md:648cred-paths
    | Committing `.env` files with real credentials                                                            | Security risk                                      
  • 严重 core/configuration.md:648cred-paths
    | Committing `.env` files with real credentials                                                            | Security risk                                      
  • 严重 core/configuration.md:648cred-paths
    | Committing `.env` files with real credentials                                                            | Security risk                                      
  • 严重 core/nextjs.md:23cred-paths
    # .env.test — loaded by Next.js automatically when NODE_ENV=test
  • 严重 core/nextjs.md:125cred-paths
    ### Environment Variables with `.env.test`
  • 严重 core/nextjs.md:127cred-paths
    Next.js loads `.env.test` automatically when `NODE_ENV=test`. Use this for test-specific overrides.
  • 严重 core/nextjs.md:130cred-paths
    # .env.test (commit this -- no real secrets)
  • 严重 core/nextjs.md:135cred-paths
    # .env.test.local (gitignored -- real test secrets)
  • 严重 core/nextjs.md:141cred-paths
    # .gitignore
  • 严重 core/nextjs.md:1011cred-paths
    | Skip `.env.test` and hardcode test values in config             | Values scatter across config and test files; hard to maintain                               
  • 严重 core/nextjs.md:1011cred-paths
    | Skip `.env.test` and hardcode test values in config             | Values scatter across config and test files; hard to maintain                               

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Playwright Skill

> Opinionated, production-tested Playwright guidance — every pattern includes when (and when _not_) to use it.

50+ reference guides covering the full Playwright surface: selectors, assertions, fixtures, page objects, network mocking, auth, visual regression, accessibility, API testing, CI/CD, debugging, and more — with TypeScript and JavaScript examples throughout.

Golden Rules

  1. getByRole() over CSS/XPath — resilient to markup changes, mirrors how users see the page
  2. Never page.waitForTimeout() — use expect(locator).toBeVisible() or page.waitForURL()
  3. Web-first assertionsexpect(locator) auto-retries; expect(await locator.textContent()) does not
  4. Isolate every test — no shared state, no execution-order dependencies
  5. baseURL in config — zero hardcoded URLs in tests
  6. Retries: 2 in CI, 0 locally — surface flakiness where it matters
  7. Traces: 'on-first-retry' — rich debugging artifacts without CI slowdown
  8. Fixtures over globals — share state via test.extend(), not module-level variables
  9. One behavior per test — multiple related expect() calls are fine
  10. Mock external services only — never mock your own app; mock third-party APIs, payment gateways, email

Guide Index

Writing Tests

| What you're doing | Guide | Deep dive |

| -------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------ |

| Choosing selectors | [locators.md](core/locators.md) | [locator-strategy.md](core/locator-strategy.md) |

| Assertions & waiting | [assertions-and-waiting.md](core/assertions-and-waiting.md) | |

| Organizing test suites | [test-organization.md](core/test-organization.md) | [test-architecture.md](core/test-architecture.md) |

| Playwright config | [configuration.md](core/configuration.md) | |

| Page objects | [page-object-model.md](pom/page-object-model.md) | [pom-vs-fixtures-vs-helpers.md](pom/pom-vs-fixtures-vs-helpers.md) |

| Fixtures & hooks | [fixtures-and-hooks.md](core/fixtures-and-hooks.md) | |

| Test data | [test-data-management.md](core/test-data-management.md) | |

| Auth & login | [authentication.md](core/authentication.md) | [auth-flows.md](core/auth-flows.md) |

| API testing (REST/GraphQL) | [api-testing.md](core/api-testing.md) | |

| Visual regression | [visual-regression.md](core/visual-regression.md) | |

| Accessibility | [accessibility.md](core/accessibility.md) | |

| Mobile & responsive | [mobile-and-responsive.md](core/mobile-and-responsive.md) | |

| Component testing | [component-testing.md](core/component-testing.md) | |

| Network mocking | [network-mocking.md](core/network-mocking.md) | [when-to-mock.md](core/when-to-mock.md) |

| Forms & validation | [forms-and-validation.md](core/forms-and-validation.md) | |

| File uploads/downloads | [file-operations.md](core/file-operations.md) | [file-upload-download.md](core/file-upload-download.md) |

| Error & edge cases | [error-and-edge-cases.md](core/error-and-edge-cases.md) | |

| CRUD flows | [crud-testing.md](core/crud-testing.md) | |

| Drag and drop | [drag-and-drop.md](core/drag-and-drop.md) | |

| Search & filter UI | [search-and-filter.md](core/search-and-filter.md) | |

Debugging & Fixing

| Problem | Guide |

| -------------------------- | --------------------------------------------- |

| General debugging workflow | [debugging.md](core/debugging.md) |

| Specific error message | [error-index.md](core/error-index.md) |

| Flaky / intermittent tests | [flaky-tests.md](core/flaky-tests.md) |

| Common beginner mistakes | [common-pitfalls.md](core/common-pitfalls.md) |

Framework Recipes

| Framework | Guide |

| ----------------------------------- | ----------------------------- |

| Next.js (App Router + Pages Router) | [nextjs.md](core/nextjs.md) |

| React (CRA, Vite) | [react.md](core/react.md) |

| Vue 3 / Nuxt | [vue.md](core/vue.md) |

| Angular | [angular.md](core/angular.md) |

Migration Guides

| From | Guide |

| -------------------- | ---------------------------------------------- |

| Cypress | [from-cypress.md](migration/from-cypress.md) |

| Selenium / WebDriver | [from-selenium.md](migration/from-selenium.md) |

Architecture Decisions

| Question | Guide |

| --------------------------- | ------------------------------------------------------------------ |

| Which locator strategy? | [locator-strategy.md](core/locator-strategy.md) |

| E2E vs component vs API? | [test-architecture.md](core/test-architecture.md) |

| Mock vs real services? | [when-to-mock.md](core/when-to-mock.md) |

| POM vs fixtures vs helpers? | [pom-vs-fixtures-vs-helpers.md](pom/pom-vs-fixtures-vs-helpers.md) |

CI/CD & Infrastructure

| Topic | Guide |

| --------------------------------- | --------------------------------------------------------------- |

| GitHub Actions | [ci-github-actions.md](ci/ci-github-actions.md) |

| GitLab CI | [ci-gitlab.md](ci/ci-gitlab.md) |

| CircleCI / Azure DevOps / Jenkins | [ci-other.md](ci/ci-other.md) |

| Parallel execution & sharding | [parallel-and-sharding.md](ci/parallel-and-sharding.md) |

| Docker & containers | [docker-and-containers.md](ci/docker-and-containers.md) |

| Reports & artifacts | [reporting-and-artifacts.md](ci/reporting-and-artifacts.md) |

| Code coverage | [test-coverage.md](ci/test-coverage.md) |

| Global setup/teardown | [global-setup-teardown.md](ci/global-setup-teardown.md) |

| Multi-project config | [projects-and-dependencies.md](ci/projects-and-dependencies.md) |

Specialized Topics

| Topic | Guide |

| ------------------------------------------ | ----------------------------------------------------------------------- |

| Multi-user & collaboration | [multi-user-and-collaboration.md](core/multi-user-and-collaboration.md) |

| WebSockets & real-time | [websockets-and-realtime.md](core/websockets-and-realtime.md) |

| Browser APIs (geo, clipboard, permissions) | [browser-apis.md](core/browser-apis.md) |

| iframes & Shadow DOM | [iframes-and-shadow-dom.md](core/iframes-and-shadow-dom.md) |

| Canvas & WebGL | [canvas-and-webgl.md](core/canvas-and-webgl.md) |

| Service workers & PWA | [service-workers-and-pwa.md](core/service-workers-and-pwa.md) |

| Electron apps | [electron-testing.md](core/electron-testing.md) |

| Browser extensions | [browser-extensions.md](core/browser-extensions.md) |

| Security testing | [security-testing.md](core/security-testing.md) |

| Performance & benchmarks | [performance-testing.md](core/performance-testing.md) |

| i18n & localization | [i18n-and-localization.md](core/i18n-and-localization.md) |

| Multi-tab & popups | [multi-context-and-popups.md](core/multi-context-and-popups.md) |

| Clock & time mocking | [clock-and-time-mocking.md](core/clock-and-time-mocking.md) |

| Third-party integrations | [third-party-integrations.md](core/third-party-integrations.md) |

CLI Browser Automation

| What you're doing | Guide |

| ------------------------------------------- | ------------------------------------------------------------------- |

| CLI browser interaction | [playwright-cli/SKILL.md](playwright-cli/SKILL.md) |

| Core commands (open, click, fill, navigate) | [core-commands.md](playwright-cli/core-commands.md) |

| Network mocking & interception | [request-mocking.md](playwright-cli/request-mocking.md) |

| Running custom Playwright code | [running-custom-code.md](playwright-cli/running-custom-code.md) |

| Multi-session browser management | [session-management.md](playwright-cli/session-management.md) |

| Cookies, localStorage, auth state | [storage-and-auth.md](playwright-cli/storage-and-auth.md) |

| Test code generation from CLI | [test-generation.md](playwright-cli/test-generation.md) |

| Tracing and debugging | [tracing-and-debugging.md](playwright-cli/tracing-and-debugging.md) |

| Screenshots, video, PDF | [screenshots-and-media.md](playwright-cli/screenshots-and-media.md) |

| Device & environment emulation | [device-emulation.md](playwright-cli/device-emulation.md) |

| Complex multi-step workflows | [advanced-workflows.md](playwright-cli/advanced-workflows.md) |

Language Note

All guides include TypeScript and JavaScript examples. When the project uses .js files or has no tsconfig.json, examples are adapted to plain JavaScript.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。