Playwright Security Hygiene

Checks the mechanical, easy-to-get-wrong hygiene basics — a cookie missing a security flag, a source map left publicly accessible, an outdated library with a known CVE — not an assessment of the site's actual security posture.

Scope boundary — read this first

This is hygiene, not a security audit. Every check here is passive observation: reading an HTTP response header, reading a cookie's declared attributes, requesting a file the server would serve to anyone who asked, matching a script's signature against a public vulnerability database. None of it involves crafting a payload, attempting to bypass a control, or confirming a finding is actually exploitable.

Concretely, this skill never:

• Attempts SQL injection, XSS, CSRF, or any other injection/exploit payload
• Attempts to bypass authentication or access data that isn't its own
• Systematically enumerates arbitrary paths looking for what exists (that's reconnaissance, a different activity from checking a short, well-known list of common accidental-exposure paths)
• Tries to confirm or escalate a finding once observed — a missing header or an exposed file gets reported and the check stops there

Passing every check here is not evidence the site is secure. If genuine security assurance is needed, that requires a qualified security professional or a dedicated engagement — this skill catches common, easy-to-fix misconfigurations, nothing more.

Relationship to the other skills

Reuse scenario-mapper's page list. Reuse link-audit's lightweight-HTTP-check technique for the exposed-file checks, rather than re-deriving it.