agentleFS
Sign inStart free
drenBuzadrenBuza/e2e-testing/SKILL.md

e2e-testing

Skill1 starsChanged 5 months agoMITView on GitHub

Standardized GitNexus + Playwright E2E journey testing PLUS an authenticated security pass (authz/IDOR/privilege-escalation/mass-assignment/CORS/refresh-rotation/headers/rate-limit/injection) and a reusable prod-mock environment. Use to set up or run end-to-end tests that trace a user journey from frontend call through backend to database save, to security-test an app's auth/object-level authorization, or to stand up an isolated prod-mock for safe testing. Across any app format (monolith, SPA+API, microservices, serverless). Trigger when setting up E2E or security testing in a repo, testing user journeys end-to-end, or hardening an API against IDOR/privilege escalation.

95 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use everything-claude-code, investor-materials and 10 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • InfopibeSkill

    everything-claude-code

    Also in 10 projects that use this

  • InfopibeSkill

    investor-materials

    Create and update pitch decks, one-pagers, investor memos, accelerator applications, financial models, and fundraising materials. Use when the user needs investor-facing documents, projections, use-of-funds tables, milestone plans, or materials that must stay internally consistent across multiple fundraising assets.

    Also in 28 projects that use this

  • mryeastcodeSkill

    everything-claude-code-conventions

    Development conventions and patterns for everything-claude-code. JavaScript project with conventional commits.

    Also in 8 projects that use this

  • tpavanipradeepSkill

    bun-runtime

    Bun as runtime, package manager, bundler, and test runner. When to choose Bun vs Node, migration notes, and Vercel support.

    Also in 18 projects that use this

  • niloykumarbarmanSkill

    agent-sort

    Build an evidence-backed ECC install plan for a specific repo by sorting skills, commands, rules, hooks, and extras into DAILY vs LIBRARY buckets using parallel repo-aware review passes. Use when ECC should be trimmed to what a project actually needs instead of loading the full bundle.

    Also in 8 projects that use this

  • niloykumarbarmanSkill

    product-capability

    Translate PRD intent, roadmap asks, or product discussions into an implementation-ready capability plan that exposes constraints, invariants, interfaces, and unresolved decisions before multi-service work starts. Use when the user needs an ECC-native PRD-to-SRS lane instead of vague planning prose.

    Also in 9 projects that use this

  • +1 more from Infopibe

The file

We split this skill into the rules it gives an agent

3 rules. 0 are common, 1 is distinctive, and 2 are very specific to this project.

  • 0

    Common

    Most of the 43 edited versions we read keep these.

  • 1

    Distinctive

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    If you have no shell access, do it manually: copy journeys-e2e.md to .claude/commands/ and e2e-journey-test-prompt.md to …

    line 25
  2. Distinctive:

    Check out the parent repo.

    line 30
  3. Very specific:

    Run /journeys-e2e (or /journeys-e2e <area> to scope).

    line 32

“Common” is measured: kept by at least 6 in 10 of the 43 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

E2E Journey Testing (GitNexus + Playwright)

This skill installs a /journeys-e2e slash command that discovers user journeys from the GitNexus graph, lets the user pick which to test, then generates and runs Playwright tests covering both frontend (browser) and backend (request/API) through to the database write — with the dev stack brought up and torn down automatically. The journey grouping (process → steps) is the portable contract; the harness adapts per app format.

Per-project setup

To wire this into a repo, run the installer from the repo root:

  • Windows / PowerShell: powershell -File <path-to-skill>\setup.ps1 -RepoPath .
  • Git Bash / macOS / Linux: bash <path-to-skill>/setup.sh .

The installer is idempotent (re-run safely; pass -Force / --force to overwrite). It places:

  • .claude/commands/journeys-e2e.md → the invokable command
  • .claude/e2e-journey-test-prompt.md → the harness-matrix / per-journey reference the command reads

If you have no shell access, do it manually: copy journeys-e2e.md to .claude/commands/ and e2e-journey-test-prompt.md to .claude/e2e-journey-test-prompt.md in the target repo.

Using it (after setup)

  1. Check out the parent repo.
  2. Confirm GitNexus is up and indexed (npx gitnexus analyze if stale).
  3. Run /journeys-e2e (or /journeys-e2e <area> to scope). Pick journeys from the presented list.

The command handles Playwright install, stack-up, auth, test generation/run, teardown, and persists the journey→process→test mapping to CLAUDE.md. No other packages are installed without asking.

Security pass + prod-mock

Beyond functional journeys, this skill carries a security-testing + prod-mock reference: security-and-prod-mock.md (deployed to .claude/). It defines the authenticated security matrix (authN/RBAC, IDOR/BOLA read+write, the create-as-owner→cross-access IDOR sweep, register privilege escalation, mass-assignment, JWT tamper, refresh-token rotation, rate-limit, injection, headers, CORS, SSRF, file-upload, enumeration), the common backend root causes + fix shapes (missing object-level authz, the IsAdmin = HasPermission(...) antipattern, trusting client-supplied role on register), and a reusable prod-mock (real pipeline + ephemeral DB + externals stubbed behind a flag + CI gate) with the hard-won flakiness lessons (rate-limiter token reuse, refresh-token invalidation, reported vs hard-fail layers). Tests live under e2e/security/*.security.spec.ts. Always pair each deny test with an owner positive control, and state honestly what remains untested — no suite proves "pen-test immune".

Files in this skill

  • journeys-e2e.md — the slash command (deployed to .claude/commands/)
  • e2e-journey-test-prompt.md — the journey reference spec (deployed to .claude/)
  • security-and-prod-mock.md — the security-suite + prod-mock reference (deployed to .claude/)
  • setup.ps1 / setup.sh — per-project installers

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free