setup-playwright — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-playwright (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build the smallest reliable Playwright harness that fits the repository already in front of you.
This is a system skill: it leaves behind repo-owned test setup, config, and a starter check. Day-to-day spec authoring belongs to playwright-testing. Preserve the repo's existing Playwright ecosystem shape instead of forcing Node @playwright/test into Python, .NET, or Java repos that already have a clear runner choice.
Use the repo's strongest local signal:
@playwright/test
.NET install flow
wiring
specs already exist (config-shape changes belong here)
webServer, browser install, browser projects, storageState,sharding, or CI reporter setup
playwright-testing
playwright-testing
playwright-cli, UI Mode, or codegen — routeto playwright-testing
digraph route {
"Working Playwright harness exists?" [shape=diamond];
"Main artifact is config,\nbrowser install, or auth plumbing?" [shape=diamond];
"setup-playwright" [shape=box];
"playwright-testing" [shape=box];
"Working Playwright harness exists?" -> "setup-playwright" [label="no"];
"Working Playwright harness exists?" -> "Main artifact is config,\nbrowser install, or auth plumbing?" [label="yes"];
"Main artifact is config,\nbrowser install, or auth plumbing?" -> "setup-playwright" [label="yes"];
"Main artifact is config,\nbrowser install, or auth plumbing?" -> "playwright-testing" [label="no"];
}defaults, test layout, or deterministic coverage expectations.
or another principle skill when setup needs non-trivial code in that language.
must validate UI behavior, accessibility, responsiveness, or visible layout.
design, visual QA, or flake review.
choose the correct Playwright harness shape for Node, Python, .NET, or Java; preserve the repo's runner and install commands.
Node Playwright Test patterns for auth.setup.ts + setup-project wiring, API login, one account per worker, CI posture, sharded reports.
— Node Playwright Test defaults for config scope, projects/dependencies, browser and channel selection, emulation, timeouts, reporters, webServer.
Reference naming note:
auth-and-ci-patterns.md and browser-and-config-patterns.md keep theirhistorical names, but they are intentionally Node Playwright Test-only.
references/ecosystem-patterns.md rather than widening the Node helpers until they become ambiguous.
package.json, pyproject.toml,.csproj, pom.xml, build.gradle, lockfiles, workspace config, existing test folders, Playwright config, CI files, ignore files, app docs, route files, and any auth or test-id signals. Identify the package manager, app root, likely test language, start command, base URL, auth flow, configured testIdAttribute, browser or device expectations, and whether this is a monorepo or a migration from another E2E tool.
what the repo does not already answer:
webServer, or the external URLthe harness will hit.
auth plus ignored storageState.
deliberately mocked external boundary.
regression cadence.
exists, extend or repair instead of re-scaffolding. In monorepos, preserve the correct package boundary; ask before adding dependencies when multiple packages are equally plausible. Preserve the repo's existing language and runner. Use the repo's native Playwright stack: @playwright/test for Node, Playwright Pytest for Python, Playwright's base classes and playwright.ps1 flow for .NET, and the repo's chosen Java test framework with Playwright dependencies and CLI wiring for Java. If no stronger signal exists, default to Node Playwright Test for repo-owned E2E. Do not switch to the raw playwright library unless the user explicitly wants library automation outside the test runner.
use the ecosystem's normal layout: Node commonly uses tests/, e2e/, or tests/e2e/; Python follows the repo's tests/ and pytest config shape; .NET and Java should stay inside the existing test project or module instead of inventing a parallel Node-style tree.
smallest durable playwright.config.* that fits: testDir, use.baseURL, CI-safe forbidOnly, retries: process.env.CI ? 2 : 0, workers: process.env.CI ? 1 : undefined, reporter defaults that fit agent and CI use, trace: 'on-first-retry', screenshot: 'only-on-failure', and webServer when the app has a stable start command. Preserve or define testIdAttribute when the repo uses an explicit test-id contract. For Python, preserve pytest config and CLI defaults instead of fabricating playwright.config.ts. For .NET, preserve the existing test framework and use runsettings or launch options rather than Node config files. For Java, preserve the repo's test framework and build-tool wiring rather than introducing a Node-style runner. Enable fullyParallel only when the suite is truly isolation-safe. When many tests need the same authenticated user, use ignored storageState or the closest ecosystem-native equivalent.
fixtures, page objects, or setup helpers when flows or setup repeat. Prefer fixtures over broad beforeEach. Use route mocking only for external or intentionally injected boundaries, and block service workers when they would swallow page.route(). In Node Playwright Test, use projects for meaningful browser, device, environment, or setup-dependency differences and test.use() for narrower per-file or per-describe overrides such as locale, timezone, permissions, color scheme, or viewport. In other ecosystems, use the runner's equivalent local override mechanism instead of inventing Node abstractions.
style the repo already uses. Keep Playwright as a separate E2E entrypoint unless the repo already treats it as default. Default CI posture is a smoke gate on pull requests; a broader matrix only when the repo or user needs that evidence.
app loads, a landmark or heading is visible, and one core navigation or interaction works. Use web-first assertions and user-facing locators.
browsers when needed, then run the smallest meaningful runner command for the changed setup. Start with one file, one module, or one browser target and the narrowest useful output for that ecosystem. --list proves discovery only; run at least one real test when the environment allows it.
boundary, package manager, config path, test directory, scripts added, validation command, and any setup assumptions the next agent or developer must know.
Before the first Playwright-backed test invocation:
127.0.0.1 (unless the environmentrequires another bind) and verify the port is free. Do not let webServer race a manually started dev server on the same port.
EPERM or EACCES,escalate rather than retry-loop.
.next/lockonly after confirming no active owner remains.
(for example test-results/ or playwright-report/ in Node setups) and any auth-state path are writable and ignored when appropriate.
available, then install only what the repo's scope actually requires. Re-run browser install after Playwright version upgrades.
Boundary and scope
scripts.
replace lower-level testing.
plausible app packages and no clear target.
Chrome extension testing, and WebView2 automation need specialized setup; do not silently fold them into the default web-app harness.
npx playwright init-agents unless the user explicitly wants repo-owned planner/generator/healer definitions.
playwright.config.ts, auth.setup.ts, or Node packagescripts inside Python, .NET, or Java repos just to imitate the Node docs.
Package manager and ecosystem
introduce a second package manager.
classes, and Java test-framework integrations as first-class. Use Node @playwright/test only when the repo is already Node-based or no stronger stack signal exists.
Install hygiene
package, rerun the Playwright install command for the browsers you actually need.
@playwright/cli as a repo dependency just to investigatethe app. Keep playwright-cli as agent tooling unless the user explicitly asks for reusable repo-owned browser automation.
Config shape
webServer in config over telling usersto start the app manually, unless the repo's start process is intentionally external.
globalSetup /globalTeardown. Use global hooks only for genuinely non-fixture bootstrap or environment-variable handoff outside the normal runner model.
test.use() ortest.describe(() => test.use(...)) for narrow locale, timezone, permissions, color-scheme, or viewport overrides instead of adding another whole project.
fullyParallel only when tests are genuinely order-independent;it amplifies shared-state bugs.
is the constraint. Default to bundled Chromium; opt into branded Chrome or Edge channels only when stable-channel parity, codec behavior, or a browser-policy environment actually requires it.
not type-check it. Preserve or add a separate tsc --noEmit step when the repo expects type safety.
Auth plumbing
storageStatewhen reusable login is needed. In other ecosystems, keep the same intent but wire it through the runner's fixtures, helpers, or base classes.
sessionStorage, inject it withaddInitScript or the closest ecosystem-native equivalent.
Document how auth state is refreshed manually when it expires.
Artifacts and hygiene
reports out of git unless the repo has a deliberate artifact policy.
rendering is itself a maintained contract.
starter tests. The starter must use web-first assertions.
changes only when the task explicitly includes CI or the repo already has a clear CI pattern to extend.
Common setup shortcuts and expected pushback live in references/pressure-tests.md. Load that reference when reviewing a proposed harness shortcut or revising the skill's trigger and setup rules.
identified
contract, retry policy, and artifact or reporting shape
fullyParallel, if enabled, is justified by actual test isolationrunner
typecheck behavior is explicit
conventions
Set up Playwright tests in this fresh Next.js repo. → inspect packagescripts, add Playwright Test with the repo's package manager, configure webServer on 127.0.0.1:<port>, create a starter smoke test, run it in Chromium with --reporter=line.
Set up Playwright browser tests in this Python repo. → preserve pytest,add Playwright Pytest and browser install commands, keep config in pytest files or fixtures instead of inventing playwright.config.ts, validate with a narrow pytest run.
Add an E2E harness to this app without disturbing unit tests. → keepthe existing unit-test layout intact, add Playwright at the repo's native test boundary, keep its commands separate from unit-test entry points, and validate only the new harness.
Add Playwright coverage to this .NET test project. → preserve MSTest,NUnit, or xUnit, wire browser installation through playwright.ps1, keep storage-state paths and runsettings in the test project, validate with dotnet test.
Add Playwright coverage to this Java Maven module. → preserve JUnit orTestNG, wire browser installation and Playwright dependencies through Maven or Gradle instead of Node scripts, keep auth setup in Java helpers, and validate with the module's existing test command.
Fix this broken playwright.config.ts after a package move. → repairpaths, base URL, scripts, and project config without re-scaffolding or replacing existing specs.
Add login reuse so tests do not log in through the UI every time. →add the runner's reusable auth mechanism with ignored storageState, document how the state is refreshed, and keep the login UI only in the tests where login itself is the claim. In Node this commonly means a setup project; in other ecosystems use fixtures, helpers, or base classes. Handled here because it changes harness shape even when specs already exist.
For doc refreshes, trigger audits, and pressure-test scenarios, see references/coverage-and-validation.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.