playwright-security-runner

Dynamic security testing with Playwright executes real payloads against web forms to identify XSS, SQL injection, authentication weaknesses, and other input-based vulnerabilities. This Skill automates payload delivery, requires user confirmation before execution, and generates structured vulnerability reports with severity and evidence.

Yes, the dry-run mode lets you plan and preview security tests without sending payloads. This allows you to review target forms and input fields before committing to full testing, ensuring you test only intended endpoints.

Consent-based testing requires explicit user confirmation before executing payloads against your application. This safety mechanism prevents accidental or unauthorized security tests and ensures you control when and where testing occurs in development and QA environments.

The Skill automatically discovers forms and enumerates input fields on target pages using Playwright browser automation. It then maps these fields for payload delivery, generating a complete inventory of testable surfaces before execution begins.

Vulnerability reports include structured findings with severity levels, target forms and fields, optional screenshots as evidence, and bounty estimates. This evidence-backed approach helps you understand and prioritize remediation of discovered vulnerabilities.

Yes, the Skill can test authentication weaknesses and secured forms by executing payloads through Playwright's browser automation. You can test protected endpoints in development and QA environments where you control access credentials.