The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with-server.py utilizes subprocess.Popen with shell=True to orchestrate server startup and shutdown. While the script includes comments identifying this as a trusted local CLI boundary required for shell syntax (such as command chaining with &&), it allows for the execution of arbitrary shell commands passed via the --server argument.
[INDIRECT_PROMPT_INJECTION]: The skill provides Playwright-based web automation capabilities that ingest data from external web applications, which can serve as a vector for malicious instructions.
Ingestion points: Browser automation scripts in examples/element-discovery.py, examples/console-logging.py, and references/webapp-testing.md extract page content (page.content()), console messages, and element attributes.
Boundary markers: There are no explicit delimiters or specific 'ignore' instructions provided to the agent to differentiate between the skill's operational instructions and the untrusted data scraped from the web.
Capability inventory: The skill includes the ability to write files (e.g., saving console logs to /mnt/user-data/outputs/console.log and screenshots to temporary directories) and execute shell commands through the server management utility.
Sanitization: No sanitization, escaping, or validation logic is implemented for the data retrieved via Playwright before it is processed by the agent.

testing