skills.rest
decniner
decninerCOMMUNITY
Explore all skills by this author →
GitHub

web-app-audit

Audit frontend web apps for bugs using static source analysis and live browser testing.

Updated Jul 3, 2026
Search Tags:#code review#xss#frontend testing#canvas games#bug hunting#drag-and-drop#web app audit
One-click install
npx skills add https://github.com/decniner/HermesP1 --skill web-app-audit-decniner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-app-audit
Source: https://github.com/decniner/HermesP1/tree/main/.hermes-backup/skills/software-development/web-app-audit
Command: npx skills add https://github.com/decniner/HermesP1 --skill web-app-audit-decniner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Frontend web apps often contain latent bugs that survive casual code review: JavaScript errors, broken drag-and-drop, localStorage corruption crashes, XSS vectors, collision-detection flaws in canvas games, and cosmetic stubs in desktop simulators. This Skill provides a systematic, layered audit methodology that combines reading the source with exercising every interaction path in a real browser. ## Core Features & Use Cases - Six-layer audit methodology: static source analysis, initialization checks, user interaction paths, data persistence, drag-and-drop quirks, and edge cases/security (XSS, accessibility, race conditions). - Specialized audit tracks: dedicated checklists for HTML5 Canvas games (state machines, collision splice bugs, scaling curves, Web Audio API) and desktop environment simulators (window managers, Minesweeper/Solitaire logic, cosmetic stub detection). - Runtime state probing: techniques for inspecting canvas game internals via browser console expressions, plus worked case studies (Space Invaders, Pac-Man, Flappy Bird, Kanban board, Win95 simulator) showing real bugs found. - Use Case: Before shipping a single-file HTML game or dashboard, run this audit to catch critical issues like collision loops that skip bullets, wave advancement after player death, or drop handlers that crash on external drags. ## Quick Start Ask the AI to audit your HTML web app for bugs using the web-app-audit skill, serving it locally with python3 -m http.server first.

Frequently Asked Questions about web-app-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit an HTML web app for bugs?▼

Work through six layers: read the full source for closure bugs and stale DOM references, load the app and check the console, test every user interaction, verify localStorage save/load round-trips, exercise drag-and-drop edge cases, and probe XSS and accessibility. Serve the app over HTTP rather than file://.

How to test HTML5 canvas games for collision bugs?▼

Trace nested for loops that splice arrays during iteration, since splice plus break commonly skips shifted elements. Also check whether multiple collision paths can call the hit handler twice in one frame, and probe runtime state via browser console expressions to verify behavior.

What is the difference between web app audit and code review?▼

Code review examines diffs and changesets before committing, while a web app audit inspects a complete codebase for latent bugs regardless of whether code is new. Use the audit for the full app and code review for incremental changes.

Why does my canvas game show nothing when tested in a headless browser?▼

requestAnimationFrame may be throttled to zero in headless or background tabs, so the game loop never runs and getImageData returns stale pixels. Draw a test pixel first to confirm the context updates, or use a visible-tab browser profile.

Can this audit find XSS vulnerabilities in my web app?▼

Yes. The audit checks whether the app uses innerHTML or insertAdjacentHTML versus textContent, and tests payloads like script tags and img onerror handlers as user input to confirm whether injection is possible.

When should I not use this web app audit skill?▼

Skip it for server-side or API code, for debugging a single known bug where systematic debugging fits better, and for subagent-driven testing workflows. It targets complete frontend HTML/JS/CSS applications.

Related Skills

Explore More Software Engineering Skills→
Agent-Pattern-LabsAgent-Pattern-Labs
4

canvas

Display HTML content on connected OpenClaw nodes via WebSocket connections.

Official
Intermediate
kiurakkukiurakku
15

code-review

Reviews code diffs and PRs for security, correctness, performance, and maintainability issues.

Community
Intermediate
Cogni-AI-OUCogni-AI-OU
3

security-review

Analyze pull request diffs to detect security vulnerabilities in incremental changes.

Official
Basic
scruffydanscruffydan

systematic-debugging

Identify root causes of software defects through a four-phase debugging workflow.

Community
Intermediate