auth-generic
Enables authentication with any custom form-based system, supporting various methods like email/password and OTP.
Install this skill
Security score
The auth-generic skill was audited on Feb 27, 2026 and we found 23 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 239 | throw new Error(`Password not configured. Set ${passwordVar} in .env.local`); |
Template literal with variable interpolation in command context
| 290 | await page.goto(`${baseUrl}${config.routes.login}`); |
Template literal with variable interpolation in command context
| 308 | throw new Error(`Unknown auth method: ${config.method}. Define custom steps.`); |
Template literal with variable interpolation in command context
| 314 | console.log(`Authentication successful, landed on ${config.routes.authenticated}`); |
Template literal with variable interpolation in command context
| 320 | console.error(`Authentication failed: ${message}`); |
Template literal with variable interpolation in command context
| 412 | await page.goto(`${baseUrl}${magicLinkUrl}`); |
Template literal with variable interpolation in command context
| 426 | const response = await fetch(`${baseUrl}${config.verification.endpoint}`, { |
Template literal with variable interpolation in command context
| 435 | throw new Error(`OTP source "${config.verification.source}" not implemented in generic skill`); |
Template literal with variable interpolation in command context
| 507 | console.log(`Logged in as ${result.email}`); |
Access to .env file
| 39 | 2. **Environment variables** in `.env.local`: |
Access to .env file
| 207 | const envPath = path.join(projectRoot, '.env.local'); |
Access to .env file
| 212 | if (match && !process.env[match[1]]) { |
Access to .env file
| 213 | process.env[match[1]] = match[2]; |
Access to .env file
| 228 | password = process.env[config.testUser.passwordVar || 'TEST_PASSWORD'] |
Access to .env file
| 232 | email = process.env[emailVar] || config.testUser.emailDefault || '[email protected]'; |
Access to .env file
| 236 | password = process.env[passwordVar] || config.testUser.passwordDefault; |
Access to .env file
| 239 | throw new Error(`Password not configured. Set ${passwordVar} in .env.local`); |
Access to .env file
| 244 | username = process.env[config.testUser.usernameVar]; |
Access to .env file
| 488 | const BASE_URL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:3000'; |
Prompting for password/secret input
| 72 | "passwordInput": "input[type='password'], input[name='password']", |
Prompting for password/secret input
| 257 | passwordInput: 'input[type="password"], input[name="password"], input#password', |
Prompting for password/secret input
| 559 | "passwordInput": "input[data-testid='password-input']", |
External URL reference
| 488 | const BASE_URL = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:3000'; |