Skip to content
SkillCodex
Menu

Mission · local progress · 8 min read

Audit a web app with an agent and verify evidence

Follow a read-only web audit mission: bound the agent’s tools, observe the user journey and verify each claim against evidence.

Direct answer

A bounded audit report ties every finding to a reproducible observation, separates local and public evidence, and lists unknowns. No fix or deployment is implied.

Sources and revision
Updated
Revision
2026-09-28 · 1d53a50086e7
Sources
3 sources
Status
Published
Read the sources

Your journey, step by step

A concept explains, a comparison helps you choose, a recipe composes a screen. This mission connects screens and decisions to the result you must verify.

Have authorization to inspect a named web app, an agent with known tool permissions, and a place outside SkillCodex to keep redacted evidence.

No account required. Only completed step IDs stay in this browser, shared across EN and FR. No external action is executed. Checks are your declarations, not evidence collected by SkillCodex.

Loading progress…

0 / 4 steps declared verified

Resume the next step: Name the audit and its limits

1 / 4 · Information

Name the audit and its limits

Screen: the audit brief. Choose a route and user task, such as reopening a saved project. State allowed reads, environment, expected result and forbidden writes. Reuse the safe-agent guide and its existing Pack.

Expected result: The brief names a verifiable result and a read-only boundary.

Common mistake: A broad “audit everything” request cannot define complete coverage.

2 / 4 · Decision

Check the actual tool permissions

Compare the requested read-only scope with the agent’s actual capabilities. Remove unnecessary write access or use an isolated test setup. If authorization or access is unclear, pause.

Expected result: Authorized scope and effective permissions agree.

Common mistake: Instructions alone are not a technical permission boundary.

3 / 4 · External action

Run the authorized observation

In your own agent tool, read the static Pack before copying it unchanged. Provide scope separately. Observe the named journey and capture route, build identity, steps, expected and actual result, with redacted evidence. Do not publish, modify accounts or fix code as part of the audit.

Perform this yourself in your tool, only if authorized. This button updates local progress; it runs no operation.

Expected result: Each finding has reproducible steps and a bounded observation.

Common mistake: A confident agent statement without a trace is not a finding.

4 / 4 · Verification

Replay and classify the evidence

Screen: audit report beside the tested app. Replay the finding. Separate local tests, Git revision, CI, deployment, HTTP and observed user behavior. A healthy endpoint does not prove the task works. Mark unavailable or conflicting proof unknown.

Expected result: The conclusion follows the evidence actually inspected, with gaps named.

Common mistake: Do not generalize from synthetic observation or claim device qualification.

Result still to verify

A bounded audit report ties every finding to a reproducible observation, separates local and public evidence, and lists unknowns. No fix or deployment is implied.

Keep evidence in your own environment. SkillCodex certifies neither an external action nor verification on a mobile device.

In this guide

01

What you verify

Have authorization to inspect a named web app, an agent with known tool permissions, and a place outside SkillCodex to keep redacted evidence.

Keep this

Final checklist

  1. 01The brief names a verifiable result and a read-only boundary.
  2. 02Authorized scope and effective permissions agree.
  3. 03Each finding has reproducible steps and a bounded observation.
  4. 04The conclusion follows the evidence actually inspected, with gaps named.

Primary sources

Technical claims in this guide connect to first-party specifications and documentation.