saw-web-target-configuration

Web Target Configuration Skill (Snyk API & Web)

Configure web application targets for Snyk API & Web security scanning with authentication support. For API targets, use the saw-api-target-configuration skill instead.

Browser Automation — Detect Before Recording

Login sequences require a real browser. Detect availability in this order:

1. playwright-cli (preferred for coding agents with Shell access)

playwright-cli --version
# or: npx @playwright/cli --version

If missing, install (no repo clone required):

npm install -g @playwright/cli@latest
playwright-cli install-browser chromium

Or, when a clone of this repo is available:

./scripts/setup-playwright.sh

Use npx @playwright/cli instead of playwright-cli when the global binary is not on PATH.

2. Playwright MCP (fallback for MCP-only clients)

Check whether Playwright MCP tools are available (e.g. browser_navigate, browser_snapshot, browser_evaluate, browser_network_requests).

If missing, tell the user to install Playwright MCP:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest"]
    }
  }
}

Or install Playwright from the Cursor Marketplace.

3. Neither available

If neither path works and the user cannot install one:

1. Tell the user that login sequences (multi-step login, 2FA) require browser automation.
2. Offer to install playwright-cli (preferred) or Playwright MCP.
3. Only if the user declines or installation fails, fall back to form login (Step 4) for simple single-page login forms.

Never guess CSS/XPath selectors without browser inspection.

Target Type Check — Do This First

Before proceeding, determine whether this is an API target or a web target:

• If the user has provided an OpenAPI/Swagger schema (URL or file), a Postman collection, or explicitly said "API target" — stop and use the saw-api-target-configuration skill instead.
• Otherwise, treat it as a web target by default. If the user just says "add a target", "create a target", or provides a URL without further qualification, proceed here.