Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/idavidov13/agentic-playwrightnpx agentmods add skills/idavidov13/agentic-playwright/api-testingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/idavidov13/agentic-playwright/api-testing)<a href="https://agentmods.dev/skills/idavidov13/agentic-playwright/api-testing"><img src="https://agentmods.dev/badge/skills/idavidov13/agentic-playwright/api-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/idavidov13/agentic-playwright/api-testing"><img src="https://agentmods.dev/badge/skills/idavidov13/agentic-playwright/api-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 13 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Tool Misuse · line 223 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00132 | $0.05007 |
| Opus 5.5 | $0.00053 | $0.02003 |
| Sonnet 5.5 | $0.00026 | $0.01001 |
| Haiku 4.5 | $0.00013 | $0.00501 |
Grade A, and why
api-testing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Do NOT** curl the endpoint first to "see what it returns" and then write schemas that match reality. How it starts
The opening of the file, as written. The whole thing — 373 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Testing
Critical
These rules are non-negotiable. Violating any of them breaks the scaffold's contract.
- NEVER hardcode API URLs, access tokens, emails, passwords, or endpoint paths. The only allowed sources of truth are
process.env.*(for URLs and credentials) and theenums/{area}/*enums (for endpoint paths, e.g.ApiEndpoints.LOGIN). - ALWAYS validate API response bodies with Zod using the exact assertion pattern
expect(SchemaName.parse(body)).toBeTruthy();. Type generics alone are not enough, andschema.parse(body)without theexpect(...).toBeTruthy()wrapper is not enough. - ALWAYS wrap each API call in
test.step()when a test contains more than one API call. - NEVER silently drop a test because the API misbehaves. Write the test as the spec says, wrap it in
test.skip, and add a// FIXME: <ticket-url>comment. - NEVER stop at
{}empty-body validation. Every request-body endpoint requires per-field omission and per-field invalid-type tests. - ALWAYS fuzz path parameters with the invalid-format data-driven loop — regardless of whether OpenAPI mentions it.
- ALWAYS use the
apiRequestfixture directly in tests. Only promote to a helper fixture when the same setup/teardown is reused across 3+ test files.
Instructions
Phase 1: Source the contract (documentation first, exploration only as fallback)
The API contract — not observed behavior — is the source of truth for schemas and tests.
- If OpenAPI / Swagger / equivalent documentation exists (the normal case):
- Build schemas and tests strictly from the documented contract: field names, types, required vs optional, nullability, status codes, error shapes.
- Do NOT curl the endpoint first to "see what it returns" and then write schemas that match reality.
- If, during test execution, the actual response disagrees with the documentation (missing field, wrong type, wrong status code, extra field), that is a bug to report, not a reason to loosen the schema. Handle it via Phase 7 (
test.skip+// FIXME: <ticket-url>).
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 373 lines · 132 tokens per session scan A 8682a35635d2
api-testing is a skill published in the GitHub repository idavidov13/agentic-playwright (232 stars, last pushed 2d ago), licensed MIT. It adds 132 tokens to every session and 5,007 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vindicate
Use when the user wants to write, add, fix, stabilize (flaky), refactor, run, or audit Playwright browser tests, draft requirements/stories from a recording (no tests), find test-coverage gaps, scaffold a Playwright project, or set up Playwright CI. Vindicate's guided workflow for grounded, conformant Playwright test…
E2E Testing Patterns
Comprehensive end-to-end testing methodologies and best practices covering architecture, test design, data management, flakiness prevention, and cross-browser strategies.
Laravel Dusk Testing
Expert-level Laravel Dusk browser testing skill for PHP/Laravel applications. Covers Chrome-based E2E testing, browser assertions, Page Objects, component testing, authentication helpers, and database integration.
JMeter Load Testing
Load and performance testing skill using Apache JMeter, covering test plans, thread groups, assertions, listeners, timers, and distributed testing.
ac-qa-e2e-review
Reviews spec implementation with E2E visual browser validation via Playwright. Triggers on keywords: e2e review, visual review, spec review, browser validation.
ac-qa-test-e2e
Executes E2E tests from definition files with Playwright browser automation. Triggers on keywords: test e2e, run e2e, execute e2e test, e2e test runner.