The Agent Skills Directory

[PROMPT_INJECTION]: The instructions in SKILL.md direct the agent to avoid reading the source code of the provided scripts unless necessary, which can limit the agent's ability to audit its tools for safety.
[COMMAND_EXECUTION]: The scripts/with_server.py utility uses subprocess.Popen with shell=True to execute startup commands provided as arguments. This is intended to support shell features like command chaining for development servers but represents a powerful execution capability.
[COMMAND_EXECUTION]: The scripts/with_server.py script executes an arbitrary command via subprocess.run after performing basic port-readiness checks on the specified servers.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from web pages and logs without sanitization.
Ingestion points: Untrusted data is read from the browser's DOM and console logs in the example scripts.
Boundary markers: There are no explicit markers or instructions to treat the ingested web content as untrusted.
Capability inventory: The skill can execute shell commands through scripts/with_server.py and has file system access.
Sanitization: There is no evidence of sanitization or filtering for the data gathered from the browser environment.

webapp-testing