Install
$ agentstack add skill-mallikarjun-roddannavar-playwright-pom-agent-skills-pw-api-pom ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
PW API POM
Maintain the API automation layer in a way that keeps tests explicit and services reusable.
Use This Skill When
- Adding a new API scenario under
api/specs. - Updating request/response handling in
api/services. - Cleaning up raw API tests so they match the service/spec boundary conventions.
- Adjusting authenticated request-context behavior in
utils/fixtures/TestFixtures.ts. - Changing auth token flow or role bootstrap behavior.
Follow These Rules
- Keep API services under
api/services. - Keep API specs under
api/specs. - Keep services assertion-free.
- Return raw
APIResponseobjects from services. - Put assertions in specs, including negative scenarios.
- Use aliases such as
@api/*,@utils/*, and@config/*.
Inspect First
- Identify the affected service, spec, fixture, and any auth/bootstrap file before editing.
- Reuse an existing service method before adding a new one.
- If the task changes credentials or token flow, inspect auth setup and fixture usage together.
- If a route is involved, inspect
BaseApiService.routesfirst.
Decide What To Edit
- Edit a service when request construction, route usage, or response parsing changes.
- Edit a spec when the expected status, payload, or role-based behavior changes.
- Edit a fixture when authenticated request-context creation changes.
- Keep assertion logic out of services even when handling failure paths.
New API Scenario Flow
- Inspect a similar spec and any related service methods.
- Reuse an existing authenticated fixture if one already matches the role.
- Add or update the service method only if the request shape is new.
- Keep all assertions in the spec body.
- Register cleanup through the shared
cleanupfixture as soon as the test has the created resource id. - Validate with the smallest relevant command set.
Cleanup Raw API Tests
- Treat direct request calls in specs as cleanup candidates when a service already owns that behavior.
- Move request construction into services.
- Keep assertions and negative-path expectations in specs.
- Reuse route constants and authenticated fixtures before adding new helpers.
- Keep the service reusable for both positive and negative scenarios.
Update Existing API Flow
- Identify whether the change belongs to route ownership, request shape, auth setup, or test expectation.
- Update the service if the API contract changed.
- Update the spec if only the expected behavior changed.
- Keep failures explicit in specs for negative-role and invalid-input scenarios.
- Avoid burying response validation inside helpers.
Service Conventions
- Reuse route constants from
BaseApiService.routes. - Do not hardcode route strings in services or specs when a constant already exists.
- Keep per-service logging scoped via
logger.withScope(...)throughBaseApiService. - Log request intent and response status, but do not add assertion logic.
Current repo examples:
AuthService.getAccessToken(username, password)returns rawAPIResponseFoldersServicereturns rawAPIResponsevalues forlist,create, andremove
When To Load References
Load references/api-boundaries.md when the task is ambiguous about service/spec/fixture ownership or auth responsibilities.
Finish Checklist
- Assertions remain in specs.
- Services still return raw
APIResponsevalues. - Persistent test data is registered with the shared
cleanupfixture. - Existing routes/constants/fixtures were reused where possible.
- Negative paths remain explicit in the spec.
- Validation matches the scope of the change.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Mallikarjun-Roddannavar
- Source: Mallikarjun-Roddannavar/playwright-pom-agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.