| name | browser-qa |
| description | Automated browser-based security testing using Playwright and browser devtools. Interact with web applications as a user would — click, type, navigate — while monitoring network traffic, JavaScript execution, and DOM changes for security issues. |
| origin | openclaw |
| version | 0.2.0.2 |
| compatibility | ["openclaw","claude-code","cursor","windsurf"] |
| allowed-tools | ["Bash","Read","Write","Edit","WebSearch","WebFetch","Agent"] |
| defense_triple_required | false |
| metadata | {"domain":"testing","tool_count":0,"guide_count":5,"last_reviewed":"2026-07-26"} |
Browser QA
Summary
Interact with web applications as a user would — click, type, navigate — while monitoring network traffic, JavaScript execution, and DOM changes for security issues.
Domain: testing
Skill Identity
| Attribute | Value |
|---|
| Domain | Security Testing |
| Skill ID | browser-qa |
| Version | 1.0.0 |
| Hacker Laws | Law 1 (Know Your Battlefield), Law 3 (Intelligence Over Force) |
| Related Skills | api-security, web-xss, web-auth |
Purpose
Automated browser-based security testing using Playwright and browser devtools. Interact with web applications as a user would — click, type, navigate — while monitoring network traffic, JavaScript execution, and DOM changes for security issues.
Core Capabilities
- Automated Navigation: Click links, fill forms, submit data
- Network Monitoring: Capture HTTP requests/responses, detect API calls
- JavaScript Execution: Run custom scripts in page context
- DOM Inspection: Query selectors, extract data, detect XSS sinks
- Screenshot/Video: Document findings visually
Use Cases
- Auth Flow Testing: Test login, logout, session handling, password reset
- CSRF Detection: Check for CSRF tokens in state-changing requests
- XSS Testing: Submit payloads via forms and monitor DOM
- Cookie Analysis: Check HttpOnly, Secure, SameSite flags
- Client-Side Security: CSP headers, SRI, HTTPS enforcement
Tools
- Playwright: Node.js/Python library for browser automation
- Puppeteer: Chrome-only automation (legacy)
- Browser DevTools Protocol: Direct CDP access for advanced use
Methodology
- Baseline capture — record clean network traffic and console logs before injecting payloads.
- Stateful navigation — drive multi-step flows (login → dashboard → settings) so client-side state mirrors real users.
- — diff request/response pairs across attacker vs. victim contexts to surface authorization gaps.
