Agent Skill · Anthropic
Web app testing skill
Anthropic's published skill for testing web applications by driving a real browser to verify behaviour rather than inspecting code.
This skill bundles executable code. Scripts shipped alongside the instructions run with the permissions of the engineer running the agent. Review the scripts, not only the SKILL.md.
What it is, and what it costs you
This skill closes the loop between writing a change and knowing it works. Instead of reasoning about whether a fix is correct, the agent drives a browser to the affected page, performs the interaction, and observes the result. For front-end work that is the difference between a plausible patch and a verified one.
Driving a browser is the highest-capability thing in this directory, and the risk is entirely about which browser and which environment. Attached to an isolated instance pointed at a local development build, this is a well-contained testing loop. Attached to a browser profile holding an engineer's live sessions, it is an authenticated actor in every service that profile can reach — and the agent's actions are indistinguishable, in every downstream audit log, from the human's.
Test targets deserve the same care. Running verification against a production application means real data passes through the model and real state may change. Against a local or ephemeral environment, neither is true. The convenience gradient runs the wrong way here — production is often the easiest thing to point at — so this is a decision worth making deliberately rather than by default.
The content the agent reads while testing is also untrusted: rendered page text can carry instructions, including text invisible to a human, which makes a session that both browses and holds credentials the configuration to avoid.
Capability profile
What this skill can reach inside your environment, and why a security team cares. Derived from the publisher's documentation, not from a scan.
- browser automation
Navigates, clicks and submits as an authenticated party wherever the browser profile has sessions.
- bundled script execution
Test harness code runs with the invoking user's permissions.
- state-changing interaction
Form submissions and clicks can alter real data if pointed at a live environment.
- untrusted page content ingestion
Rendered text, including content invisible to a human, enters the context window as apparent instruction.
Before you distribute this to a team
- Test against local or ephemeral environments
Removes both the real-data exposure and the risk of changing production state.
- Use an isolated browser profile
Never the engineer's everyday profile. An isolated profile removes inherited authentication entirely.
- Restrict reachable origins
Constrain navigation so a redirect cannot walk the agent into a consequential system.
Vincosha Assay assessment
not yet assessedWe have not published a scan verdict for Web app testing skill.
Everything above is a capability profile compiled by hand from the publisher's own public documentation on 2026-07-25. It describes what this artifact can reach and what to restrict before rolling it out. It is not a security verdict, and it should not be read as one.
When Vincosha Assaypublishes an assessment for this artifact it will appear here with a verdict, the findings behind it, and the date it ran. We would rather leave this space empty than fill it with a guess — inventing a security verdict about somebody else's software would be both wrong and dangerous.
What an assessment covers
- prompt-injection patterns in descriptions and instructions
- credential reads and outbound egress in bundled code
- over-scoped permissions and manifest claims
- typosquatted and impersonating names
- tool-manifest drift since the last approval
- content hash against the version you approved
Sources
Compiled from the publisher's own documentation and repository. Skills change — read the version you are about to install rather than trusting a profile.