ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable
$ npx -y skills add trailofbits/skills-curated --skill openai-develop-web-game --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/openai-develop-web-gameContext preview
The summary Claude sees to decide when to auto-load this skill.
Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable
name: openai-develop-web-game description: 'Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with render_game_to_text. Originally from OpenAI''s curated skills catalog.' allowed-tools: - Bash - Read - Grep - Glob - Write - Edit
Build games in small steps and validate every change. Treat each iteration as: implement → act → pause → observe → adjust.
Scripts and references are located under `{baseDir}/`.
1. **Pick a goal.** Define a single feature or behavior to implement. 2. **Implement small.** Make the smallest change that moves the game forward. 3. **Ensure integration points.** Provide a single canvas and `window.render_game_to_text` so the test loop can read state. 4. **Add `window.advanceTime(ms)`.** Strongly prefer a deterministic step hook so the Playwright script can advance frames reliably; without it, automated tests can be flaky. 5. **Initialize progress.md.** If `progress.md` exists, read it first and confirm the original user prompt is recorded at the top (prefix with `Original prompt:`). Also note any TODOs and suggestions left by the previous agent. If missing, create it and write `Original prompt: <prompt>` at the top before appending updates. 6. **Verify Playwright availability.** Ensure `playwright` is available (local dependency or global install). If unsure, check `npx` first. 7. **Run the Playwright test script.** You must run `$WEB_GAME_CLIENT` after each meaningful change; do not invent a new client unless required. 8. **Use the payload reference.** Base actions on `$WEB_GAME_ACTIONS` to avoid guessing keys. 9. **Inspect state.** Capture screenshots and text state after each burst. 10. **Inspect screenshots.** Open the latest screenshot, verify expected visuals, fix any issues, and rerun the script. Repeat until correct. 11. **Verify controls and state (multi-step focus).** Exhaustively exercise all important interactions. For each, think through the full multi-step sequence it implies (cause → intermediate states → outcome) and verify the entire chain works end-to-end. Confirm `render_game_to_text` reflects the same state shown on screen. If anything is off, fix and rerun. Examples of important interactions: move, jump, shoot/attack, interact/use, select/confirm/cancel in menus, pause/resume, restart, and any special abilities or puzzle actions defined by the request. Multi-step examples: shooting an enemy should reduce its health; when health reaches 0 it should disappear and update the score; collecting a key should unlock a door and allow level progression. 12. **Check errors.** Review console errors and fix the first new issue before continuing. 13. **Reset between scenarios.** Avoid cross-test state when validating distinct features. 14. **Iterate with small deltas.** Change one variable at a time (frames, inputs, timing, positions), then repeat steps 7–13 until stable.
Example command (actions required):
node "$WEB_GAME_CLIENT" --url http://localhost:5173 --actions-file "$WEB_GAME_ACTIONS" --click-selector "#start-btn" --iterations 3 --pause-ms 250
Example actions (inline JSON):
{
"steps": [
{ "buttons": ["left_mouse_button"], "frames": 2, "mouse_x": 120, "mouse_y": 80 },
{ "buttons": [], "frames": 6 },
{ "buttons": ["right"], "frames": 8 },
{ "buttons": ["space"], "frames": 4 }
]
}Test any new features added for the request and any areas your logic changes could affect. Identify issues, fix them, and re-run the tests to confirm they’re resolved.
Examples of things to test:
You must actually open and visually inspect the latest screenshots after running the Playwright script, not just generate them. Ensure everything that should be visible on screen is actually visible. Go beyond the start screen and capture gameplay screenshots that cover all newly added features. Treat the screenshots as the source of truth; if something is missing, it is missing in the build. If you suspect a headless/WebGL capture issue, rerun the Playwright script in headed mode and re-check. Fix and rerun in a tight loop until the screenshots and text state look correct. Once fixes are verified, re-test all important interactions and controls, confirm they work, and ensure your changes did not introduce regressions. If they did, fix them and rerun everything in a loop until interactions, text state, and controls all work as expected. Be exhaustive in testing controls; broken games are not acceptable.
Expose a `window.render_game_to_text` function that returns a concise JSON string representing the current game state. The text should include enough information to play the game without visuals.
Minimal pattern:
function renderGameToText() {
const payload = {
mode: state.mode,
player: { x: statTrail of Bits' reviewed and approved Claude Code plugins. Every skill and marketplace here has been vetted for quality and safety.
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration,…
Reverse engineers binaries using Ghidra's headless analyzer. Use when decompiling executables, extracting functions, strings,…
Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and…
Researches a topic from the last 30 days on Reddit, X, and the web. Surfaces real community discussions with engagement metrics…
Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform
Use when the task involves reading, creating, or editing `.docx` documents, especially when