AI-powered QA for Strykr trading platform. Pre-built tests for crypto, stocks, news, AI chat. CI/CD ready. Works with Cursor, Claude, ChatGPT, Copilot. Vibe-coding enabled.
Security Analysis
high confidenceThe skill is internally consistent with its stated purpose (Strykr QA automation): it contains test suites and Strykr-specific assertions, does not request credentials or unrelated resources, and its behavior matches the documentation.
Name/description match the included test suites, YAML files, and TypeScript assertions which target https://app.strykr.ai and PRISM endpoints; peerDependency on web-qa-bot is appropriate for a web QA skill. No unrelated services, binaries, or secrets are requested.
SKILL.md and package.json instruct running npm test / npx web-qa-bot to exercise suites that navigate the app, capture screenshots, and collect console/network errors — this is expected for a QA bot. Note: tests capture screenshots and console logs which may include sensitive data if run against authenticated or production sessions; the instructions do not include login steps (so running against gated pages may require separate credentials).
No install spec in the skill registry (instruction-only), but package.json indicates this is an npm package with a peerDependency (web-qa-bot). Installing via npm (or running npx) is expected; there are no external downloads, obscure URLs, or extract steps in the skill bundle itself.
The skill declares no required environment variables, no primary credential, and no config paths. The code only performs HTTP fetches against the configured baseUrl and PRISM endpoints — proportional to health checks and UI testing.
The skill is not forced-always, does not request elevated platform privileges, and does not modify other skills' configs. It runs tests and produces artifacts locally (screenshots/reports) — normal behavior for a test suite.
Guidance
This skill appears to do what it claims: run UI and API tests against https://app.strykr.ai using web-qa-bot. Before installing or running it: - Confirm you trust the web-qa-bot peer dependency and, if using the repo link in package.json, review that GitHub repo as well (registry metadata showed no homepage). - Run tests in a non-production environment if you are concerned about exposing user data; screenshots and console logs can contain sensitive information when run against authenticated pages. - If the app under test requires authentication, plan how credentials will be provided securely (the skill does not declare or manage secrets). - Consider running the test suite locally first (inspect outputs and screenshots) and review the test YAMLs for any selectors/actions you might want to adjust. If you want an even deeper check, provide the web-qa-bot implementation or the CI environment where this will run so I can look for additional integration risks.
Latest Release
v0.1.2
- Added metadata to SKILL.md: name, description, version, author, and keywords. - Enhanced description to highlight compatibility with Cursor, Claude, ChatGPT, Copilot, and vibe-coding. - No changes to functionality; documentation and metadata updates only.
More by @NextFrontierBuilds
Published by @NextFrontierBuilds on ClawHub
