Agent skill · Audited from source
E2e
skill · kdlbs/kandevAGPL-3.0 licenceAudited 18 Oct 2026 · source 786d4817799e
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 786d4817799e and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 7 findings, 0 critical or high. What it does: Write and run web E2E tests (Playwright) using TDD — locations, patterns, commands, and debugging.
Cite
Cite this page
ModelsAtlas. “E2e (kdlbs/kandev)”. Retrieved 18 Oct 2026. https://modelsatlas.com/skills/kdlbs/e2e
3 skills are called “E2e”. You are viewing kdlbs/kandev.
- kdlbs/kandev★ 972!CAUTION
- AgentsMesh/AgentsMesh★ 2.4k!CAUTION
- vellum-ai/vellum-assistant★ 1.4k✓SAFE
Trust audit
Audit 0.4.1 · source read 18 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 6 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 1 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (7)
MEDIUMInventory / provenanceinv.symlink · .claude/agents
.claude/agents
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .claude/skills
.claude/skills
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · .github/CLAUDE.md
.github/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · CLAUDE.md
CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · apps/backend/CLAUDE.md
apps/backend/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/e2e/tests/system/licenses-page.spec.ts:1
import { test, expect } from "../../fixtures/test-base";- Why
- No further detail recorded for this rule.
- Fix
- —
INFOInventory / provenanceinv.oversize · apps/web/generated/licenses.json
apps/web/generated/licenses.json
- Why
- 1506638 bytes not read
- Fix
- —
Audit 0.4.1 · source sha 786d4817799e · 18 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherkdlbs GitHub organizationOwner of the repository this skill is read from
- Source folderkdlbs/kandev/.agents/skills/e2eThe exact folder we audited
- LicenceAGPL-3.0As the repository states it
- Commit pinned for this verdict786d4817799eA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Write and run web E2E tests (Playwright) using TDD — locations, patterns, commands, and debugging.
---
name: e2e
description: Write and run web E2E tests (Playwright) using TDD — locations, patterns, commands, and debugging.
---
# E2E Tests
## Execution Context
Write and run E2E coverage directly in the primary conversation. For a
cost-controlled feature workflow, the user switches that conversation to the
lower-cost implementation/test model before this phase.
Write E2E tests using TDD (Red-Green-Refactor). Always run the tests you create and watch them fail before implementing.
## Related skills
- **`/tdd`** — Follow the Red-Green-Refactor cycle when writing tests.
- **`/pr-fixup`** — Use after the PR opens only for CI or reviewer findings.
- **`/playwright-cli`** — Interactive browser automation. Use to validate features against the dev server before writing tests, and to debug failing tests with `--debug=cli`.
## References
Load `references/fixture-state.md` for capability-readiness, remembered
workflow selection, cross-record correlation, restart persistence, and
provider-backed PR feedback fixture rules.
Load `references/ui-state-and-cleanup.md` for lifecycle, WebSocket, terminal,
Dockview, and sidebar/context-menu rules.
## Location
`apps/web/e2e/`
```
apps/web/e2e/
├── fixtures/
│ ├── backend.ts # Worker-scoped backend + frontend process
│ ├── test-base.ts # Extended fixture (apiClient, seedData, testPage)
│ └── office-fixture.ts # Office fixtures (officeApi, officeSeed with workspace+agent)
├── helpers/
│ ├── api-client.ts # HTTP client for seeding data (read for available methods)
│ └── office-api-client.ts # Office-specific API client (onboarding, issues, agents)
├── pages/ # Page objects (read for available pages and methods)
└── tests/ # Spec files (*.spec.ts), grouped by feature
├── task/ # Task creation, deletion, archiving, environment, subtasks
├── kanban/ # Kanban board, mobile kanban, preview panel
├── session/ # Session lifecycle, resume, recovery, multi-session, layout
├── workflow/ # Workflow steps, settings, automation, import/export
├── git/ # Git changes panel, commits, diffs, symlinks
├── pr/ # PR detection, watchers, changes panel
├── terminal/ # Terminal agent, keyboard, settings
├── chat/ # Quick chat, message queue, clarification, markdown, toolbar
├── settings/ # Config management, agent profiles, editor integration
└── review/ # Code review diffs
```
Each worker gets an isolated backend, frontend, database, and mock agent — no Docker, no API keys needed.
## Run commands
**Always run headless** (`make test-e2e`). Never use `--headed`, `e2e:headed`, or `test-e2e-headed` — headed mode requires a display and will fail in agent environments.
**Fresh worktree bootstrap:** Before the first pnpm or E2E command in a new
worktree, install the workspace dependencies:
```bash
cd apps && pnpm install --frozen-lockfile
```
Do this once before changing into `apps/web` or running a filtered package
command. Shared `.git` metadata does not include `apps/node_modules`.
### Preferred: `pnpm e2e:run` (managed runner — builds, runs, tears down)
`e2e/scripts/run-e2e.sh` handles the build, the run, and cleanup in one command. Use it instead of stitching the steps together. It auto-selects docker vs host, runs a resource-bounded number of shards concurrently, enforces one Playwright worker per shard and strict WS accounting by default (matching CI), and never leaves root-owned artifacts behind.
```bash
cd apps/web
pnpm e2e:run # auto: docker if daemon + CI image available, else host; builds first
pnpm e2e:run tests/task/my-test.spec.ts # single file (extra args pass through to Playwright)
pnpm e2e:run tests/path/spec.ts -- --grep "exact test name" # exact CI failure with a fresh build
pnpm e2e:run --shards 3 # 3 shards concurrently on this machine (isolated)
pnpm e2e:run --no-build -- --grep "task creation" # runner options before --; Playwright options after
pnpm e2e:run --no-build --project mobile-chrome tests/layout/mobile-spa-resilience.spec.ts
pnpm e2e:docker # force the docker CI image (full isolation from a host dev instance)
pnpm e2e:clean # remove build/test artifacts, incl. root-owned ones from prior docker runs
```
**Select the owning Playwright project.** The default `chromium` project
intentionally excludes routing, auth, mobile, and container suites; a matching
path with the wrong project exits with `No tests found`. Pass the project before
the spec path, for example:
```bash
pnpm e2e:run --project auth tests/auth/auth-lifecycle.spec.ts
pnpm e2e:run --project routing tests/office-routing-<name>.spec.ts
pnpm e2e:run --project containers tests/docker/<name>.spec.ts
```
Use `mobile-chrome` only for `mobile-*.spec.ts` files. Confirm Playwright discovers the intended test count before treating a focused command as evidence.
`e2e:run` accepts one `--project`; repeating it selects only the last value, so run desktop and mobile separately when both are required and confirm discovery for each.
Read [resource-safety.md](references/resource-safety.md) for full-run limits and compact output before managed E2E runs or full local suites.
The runner solves the sharp edges hand-rolling would hit: in docker it builds the CGO backend on the **host** and runs it in the runtime image (forward-compatible when the host glibc ≤ the image's — the usual case; it smoke-tests this and only falls back to the build image if the host is newer), builds the Vite web assets on the host, runs them through the Go-served SPA, and keeps Playwright output container-local. See `apps/web/e2e/README.md` → "the managed runner".
`--no-build` reuses Vite, backend, and packaged fixtures; prefer normal managedExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 786d481
git clone https://github.com/kdlbs/kandev git -C kandev checkout 786d4817799e
The author documents no install command, so this uses the repository directly. Our verdict covers commit 786d4817799e only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
786d4817799e
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/kdlbs/e2e/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All coding & review skills →kdlbs/kandev
Debug an ACP agent CLI by spawning it, speaking raw JSON-RPC, and capturing every frame to a JSONL file. Use when the user asks to probe an agent's capabilities, compare agents, test a prompt against an agent, inspect…
kdlbs/kandev
Add a new third-party integration (Jira/Linear-style) — per-workspace credentials, 90s auth-health poller, settings page, link/import buttons. Use when scaffolding a new external service integration.
kdlbs/kandev
Delete local branches whose remote has been deleted ([gone]), including their worktrees. Use for branch cleanup after merging PRs.
kdlbs/kandev
Review changed code for quality, security, and architecture compliance. Use only when the user explicitly requests local review or a PR finding requires it.
kdlbs/kandev
Stage and commit changes using Conventional Commits. Use when there are dirty/staged files to commit, the user says "commit", or before pushing a PR.
kdlbs/kandev
AI Kanban & Development Environment. Orchestrate multiple agents, review changes, open PRs. Multi-provider, self-hostable, no telemetry.
Add this badge to your README
[](https://modelsatlas.com/skills/kdlbs/e2e/)
<a href="https://modelsatlas.com/skills/kdlbs/e2e/"><img src="https://modelsatlas.com/skills/kdlbs/e2e/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about E2e
What does the E2e skill do?
Is E2e safe to install?
What can E2e access on my machine?
Which assistants does E2e work with?
How current is this page?
Sources
- github.com/kdlbs/kandev/tree/main/.agents/skills/e2e — the audited source at commit 786d4817799e and every finding aboveObserved · 18 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the E2e skill do?
- Is E2e safe to install?
- What can E2e access on my machine?