菜单
Security-first visual testing combining URL validation, PII detection, and visual regression with parallel viewport support. Use when testing web applications that handle sensitive data, need visual regression coverage, or require WCAG accessibility compliance.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/proffesor-for-testing/agentic-qe --skill security-visual-testing命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Ruflo is a multi-agent orchestration platform for AI coding agents (Claude Code, Cursor, Codex, Copilot, Gemini, Amp, +12 more). Use this skill when the user wants to (1) install/init ruflo in a project, (2) run multi-agent swarms with hierarchical coordination, (3) use ruflo's 314+ MCP tools for memory, routing, hooks, sub-agents, or workflows, (4) check ruflo status/version/doctor health, or (5) discover which of ruflo's 30+ plugins fits their task.
Build dependency-aware execution plans for complex Agentic QE, Ruflo, integration, migration, or multi-stream engineering programs. Use when Codex must turn research or requirements into phased work, select a small AQE fleet, map critical paths and parallel streams, define acceptance gates, or sequence risky changes. Use aqe-plan-quality instead when the primary output is only a test or quality plan.
Conduct evidence-first technical research for Agentic QE, Ruflo, related ruvnet projects, or external tools. Use when Codex must investigate a repository, compare current upstream changes, trace dependencies and history, distinguish verified facts from inference, or synthesize findings into actionable engineering recommendations. Do not use for a simple known-answer lookup or an implementation-only task.
基于 SOC 职业分类
正在显示 SKILL.md
| name | security-visual-testing |
| description | Security-first visual testing combining URL validation, PII detection, and visual regression with parallel viewport support. Use when testing web applications that handle sensitive data, need visual regression coverage, or require WCAG accessibility compliance. |
| category | specialized-testing |
| priority | high |
| tokenEstimate | 1400 |
| agents | ["qe-visual-tester","qe-security-scanner","qe-accessibility-auditor"] |
| implementation_status | stable |
| optimization_version | 1 |
| last_optimized | "2026-01-21T00:00:00.000Z" |
| dependencies | ["visual-testing-advanced","security-testing","accessibility-testing"] |
| quick_reference_card | true |
| tags | ["security","visual-testing","pii","accessibility","wcag","parallel-viewport","regression"] |
| trust_tier | 3 |
| validation | {"schema_path":"schemas/output.json","validator_path":"scripts/validate-config.json","eval_path":"evals/security-visual-testing.yaml"} |
Uses the qe-browser fleet skill (.claude/skills/qe-browser/) for all browser automation. The Vibium engine (10MB Go binary, WebDriver BiDi) is installed automatically by aqe init. For security-visual workflows, qe-browser adds two things on top of stock visual testing: check-injection.js (scans page content for prompt-injection patterns before screenshots are stored) and assert.js (16 typed checks including no_failed_requests for detecting data-leak requests).
# Before storing any screenshot, scan the page
vibium go "$TARGET_URL"
vibium wait load
node .claude/skills/qe-browser/scripts/check-injection.js --include-hidden
INJ=$?
if [ $INJ -ne 0 ]; then
echo "Prompt-injection findings — do NOT store screenshot"
exit $INJ
fi
# Safe to proceed with visual-diff
node .claude/skills/qe-browser/scripts/visual-diff.js --name "${PAGE_NAME}"
<default_to_action> When performing security-aware visual testing:
Quick Security-Visual Checklist:
Critical Success Factors:
| Scenario | Use This Skill? | Why |
|---|---|---|
| Testing login pages | Yes | Contains PII (passwords, emails) |
| Visual regression suite | Yes | Parallel viewport + baseline comparison |
| Payment forms | Yes | Credit card data needs masking |
| Public marketing pages | Maybe | Only if sensitive data possible |
| API-only testing | No | Use security-testing skill instead |
| Capability | Description | Performance |
|---|---|---|
| URL Validation | Block malicious URLs before navigation | <5ms |
| PII Detection | Find 6+ types of sensitive data | <100ms |
| Parallel Viewports | Test 4 viewports simultaneously | 4x faster |
| Visual Regression | Pixel-diff with configurable threshold | <500ms |
| Accessibility Audit | WCAG 2.1 A/AA/AAA compliance | <2s |
# Run complete security + visual audit
aqe test visual-audit --url https://example.com --security --accessibility
Steps:
# Capture screenshot with automatic PII masking
aqe screenshot --url https://example.com/profile --pii-safe
PII Detection Patterns:
user@example.com+1-555-123-45674111-1111-1111-1111123-45-6789sk_live_..., AKIA...Masking Strategy:
redact (black box), pixelate, blur# Test visual consistency across viewports
aqe test responsive --url https://example.com --viewports mobile,tablet,desktop
Default Viewports:
| Name | Width | Height | Device |
|---|---|---|---|
| mobile | 320px | 568px | iPhone SE |
| tablet | 768px | 1024px | iPad |
| desktop | 1440px | 900px | MacBook |
| wide | 1920px | 1080px | Full HD |
import { BrowserSecurityScanner } from '@agentic-qe/v3';
const scanner = new BrowserSecurityScanner(memory, {
urlValidation: { enabled: true },
piiDetection: { enabled: true, maskBeforeSave: true },
parallelViewports: { maxConcurrent: 4 }
});
const result = await scanner.scanUrl('https://example.com', {
viewports: ['mobile', 'tablet', 'desktop'],
accessibility: true
});
import { TrajectoryAdapter } from '@agentic-qe/v3';
const adapter = new TrajectoryAdapter(memory);
// Record testing trajectory for learning
await adapter.startTrajectory('security-visual-test', {
url: 'https://example.com',
testType: 'security-visual'
});
// ... perform tests ...
await adapter.endTrajectory(trajectoryId, {
success: true,
piiFound: 3,
visualRegressions: 0,
accessibilityScore: 95
});
aqe/security-visual/
├── baselines/* - Visual regression baselines
├── screenshots/* - Captured screenshots (PII masked)
├── reports/* - Audit reports
└── trajectories/* - Learning trajectories
const fleet = await FleetManager.coordinate({
strategy: 'security-visual-audit',
agents: [
'qe-visual-tester', // Visual regression
'qe-security-scanner', // URL/PII scanning
'qe-accessibility-auditor' // WCAG compliance
],
topology: 'parallel',
maxConcurrent: 4
});
| Error | Cause | Resolution |
|---|---|---|
URL_BLOCKED | Malicious URL pattern detected | Check URL, remove javascript:/data: |
PII_DETECTED | Sensitive data found in screenshot | Enable masking or redact manually |
BASELINE_MISSING | No baseline for comparison | Run with --update-baseline first |
VIEWPORT_TIMEOUT | Browser didn't respond | Increase timeout or reduce parallel |
ACCESSIBILITY_FAILED | WCAG violations found | Review violations, fix issues |
| Metric | Target | Measured |
|---|---|---|
| URL validation | <5ms | 2ms |
| PII detection | <100ms | 45ms |
| Single viewport capture | <2s | 1.2s |
| 4-viewport parallel | <3s | 2.1s |
| Visual diff | <500ms | 320ms |
| Accessibility audit | <2s | 1.5s |
| Full pipeline | <10s | 7.2s |