If you want the best skills for testing with AI agents, start with this shortlist, chosen on install count, maintainer, license, audit status and fit: Matt Pocock's tdd and Superpowers' test-driven-development for test-first loops, verification-before-completion for honest "done" claims, agent-browser, playwright-cli and webapp-testing for checking real pages in a browser, playwright-best-practices for writing Playwright suites, and Trail of Bits' property-based-testing. They work in Claude Code, Codex, Cursor and other agents that read SKILL.md files.
How were these skills chosen?
This is a shortlist, not a ranking. Each skill has its own page on Kipt, where we read its SKILL.md, file list and license. On 24 October 2026 we checked each against five criteria:
- Install count. The figure on the skill's skills.sh page. skills.sh says its leaderboard "ranks skills based on anonymous telemetry data collected from the skills CLI," so plugin installs and hand-copied folders aren't counted.
- Maintainer. Official tool makers (Microsoft for Playwright, Vercel, Anthropic), a security firm (Trail of Bits), or a named developer with a widely used skill library.
- License. Open licenses only. One pick uses CC-BY-SA-4.0, which we flag below.
- Audit status. skills.sh shows results from Gen Agent Trust Hub, Socket and Snyk. We report every Warn with the scanner's reason. skills.sh notes it "cannot guarantee the quality or security of every skill listed."
- Fit. Each pick covers a different testing job: test-first workflow, verification, browser testing, Playwright authoring or property-based tests.
Install counts carry the label "(snapshot, 24 October 2026)" because they change daily.
How do the top testing skills compare?
| Skill | Good for | Maintainer | Installs (snapshot, 24 October 2026) | License | Audits |
|---|---|---|---|---|---|
| agent-browser | Driving Chrome from the terminal | Vercel | 1.2M | Apache-2.0 | 2 Pass, Snyk Warn |
| tdd | TDD at agreed seams | Matt Pocock | 1.1M | MIT | 3 Pass |
| test-driven-development | Strict red, green, refactor | Jesse Vincent (Superpowers) | 259.4K | MIT | 3 Pass |
| verification-before-completion | Proof before "done" | Jesse Vincent (Superpowers) | 251.5K | MIT | 3 Pass |
| playwright-cli | Browser control and Playwright tests | Microsoft | 195.2K | Apache-2.0 | 1 Pass, 2 Warn |
| webapp-testing | Python Playwright on a local app | Anthropic | 186.9K | Apache 2.0 | 1 Pass, 2 Warn |
| playwright-best-practices | Writing and fixing Playwright suites | Currents.dev | 98.0K | MIT | 3 Pass |
| property-based-testing | Hypothesis, fast-check, proptest | Trail of Bits | 6.9K | CC-BY-SA-4.0 | 3 Pass |
What does each testing skill do, and who is it for?
agent-browser
Teaches the agent to control a real Chrome browser with the agent-browser CLI: open a URL, read the page, click, type, fill forms and take screenshots, without writing Playwright scripts.
- Suits: developers who want the agent to check a deploy or click through a flow.
- Installs: 1.2M (snapshot, 24 October 2026). License: Apache-2.0. Audits: Pass from Gen Agent Trust Hub and Socket, Warn from Snyk. Snyk's 15 September 2026 audit gives a medium overall risk level for one finding, W011 "Third-party content exposure detected," which it scores low risk (0.10), because the agent reads content from arbitrary websites.
- Kipt page: agent-browser skill
tdd
A red-green loop with one failing test at a time, written only at seams you confirm with the agent first. Its SKILL.md says tests should verify "behavior through public interfaces, not implementation details," and it calls the repo's codebase-design skill for vocabulary, so install both.
- Suits: developers who want tests that survive refactors and focus on critical paths.
- Installs: 1.1M (snapshot, 24 October 2026). License: MIT. Audits: Pass from all three.
- Kipt page: tdd skill
test-driven-development
Superpowers' strict version: write a failing test, watch it fail for the right reason, write the least code to pass, then clean up. Code written before its test gets deleted.
- Suits: teams that want TDD applied to every feature and bug fix.
- Installs: 259.4K (snapshot, 24 October 2026). License: MIT. Audits: Pass from all three.
- Kipt page: test-driven-development skill
verification-before-completion
Stops the agent from saying "done," "fixed" or "tests pass" until it has run the command that proves it and read the result.
- Suits: anyone who has had an agent report green tests that were never run.
- Installs: 251.5K (snapshot, 24 October 2026). License: MIT. Audits: Pass from all three.
- Kipt page: verification-before-completion skill
playwright-cli
Microsoft's official Playwright skill drives a browser with the playwright-cli command (snapshots, clicks, forms, request mocking, traces) and turns each step into Playwright test code.
- Suits: teams already on Playwright who want the agent to explore, then write the test.
- Installs: 195.2K (snapshot, 24 October 2026). License: Apache-2.0. Audits: Pass from Gen Agent Trust Hub, Warn from Socket and Snyk. Socket's 29 September 2026 audit flags one low-severity anomaly in a reference file whose example logs in with hardcoded credentials and saves session state to
auth.json, noting no definitive malware. Snyk's audit the same day lists W011 with a medium overall risk level, the finding itself scored low risk (0.10), because the agent reads web page content. - Kipt page: playwright-cli skill
webapp-testing
Anthropic's skill has the agent write Python Playwright scripts against a local app, with a helper script that starts your dev server, runs the test and shuts the server down.
- Suits: developers who want Claude to verify frontend work itself, and who have Python available.
- Installs: 186.9K (snapshot, 24 October 2026). License: Apache 2.0. Audits: Pass from Gen Agent Trust Hub, Warn from Socket and Snyk. Socket's 14 September 2026 audit flags one low-severity anomaly in
scripts/with_server.py, which runs the server commands you pass it through a shell, and says there is "no clear evidence of malware functionality." Snyk's audit the same day lists W011 with a medium overall risk level, the finding itself scored low risk (0.10), because the agent reads rendered page content. - Kipt page: webapp-testing skill
playwright-best-practices
A large reference set from Currents.dev covering stable locators, waits, Page Object Model, flaky tests, CI setup and more for Playwright Test in TypeScript. It is Markdown only.
- Suits: teams that maintain a Playwright suite and want agent-written tests to follow it.
- Installs: 98.0K (snapshot, 24 October 2026). License: MIT. Audits: Pass from all three.
- Kipt page: Playwright best practices skill
property-based-testing
Helps the agent write, review and triage property-based tests with Hypothesis, fast-check, proptest and other libraries. The plugin README lists three jobs, including "reviewing existing ones for tests that assert nothing."
- Suits: developers testing parsers, serializers, math or other code with clear invariants.
- Installs: 6.9K (snapshot, 24 October 2026). License: CC-BY-SA-4.0, a share-alike license: modified copies you share must use the same license. Audits: Pass from all three.
- Kipt page: property-based testing skill
How do you install a testing skill?
Use the command on the skill's skills.sh page, which runs the open source skills CLI:
npx skills add https://github.com/mattpocock/skills --skill tdd
npx skills add https://github.com/obra/superpowers --skill verification-before-completion
The CLI docs list -a to pick agents (such as -a claude-code or -a codex) and -g to install for every project. In Claude Code, personal skills live in ~/.claude/skills/ and project skills in .claude/skills/, per the Claude Code skills docs. For other agents, see Codex skills and Cursor skills.
The browser skills need more than the SKILL.md: agent-browser needs its CLI, playwright-cli needs the playwright-cli tool, and webapp-testing needs Playwright for Python. Each Kipt page lists the setup.
Which testing skills should you combine?
Pick one skill per job rather than several that compete:
- One TDD skill, not two. tdd and test-driven-development both want to own the loop and give different rules. Choose the stricter Superpowers version for full coverage, or tdd for agreed seams.
- One browser driver. agent-browser, playwright-cli and webapp-testing overlap. If your suite is already Playwright, playwright-cli plus playwright-best-practices keeps everything in one tool.
- Always add verification. verification-before-completion works alongside any of the above.
- Add property tests where invariants exist. property-based-testing complements example-based tests; it doesn't replace them.
If you build UI, the best frontend skills list includes next-dev-loop, which checks Next.js changes in the running app.
Why do browser testing skills show audit warnings?
All five Warns on this page belong to the three browser skills, and three of them are the same Snyk finding: W011, third-party content exposure. A skill that reads web pages brings outside text into the agent's context, which is a route for prompt injection. That is inherent to browser testing, not a sign of malware. Point these skills at your own apps where you can, and read the prompt injection guide before letting an agent browse freely.
Where should you keep the testing skills you choose?
Kipt keeps prompts and Agent Skills as Markdown in a private GitHub repo you own. Import a skill from a GitHub link, a folder or a .zip, and install your whole library into Claude Code or Codex with npx skills add https://github.com/<you>/<repo>.git --all -g. If you copy property-based-testing, keep its CC-BY-SA-4.0 terms; the others use MIT or Apache 2.0.
For a wider view, see the best Claude Code skills overview and the Superpowers guide, which covers the library two of these picks come from.