The Agent Skills Directory

[COMMAND_EXECUTION]: The utility scripts/with_server.py uses subprocess.Popen(shell=True) and subprocess.run() to execute arbitrary strings provided as command-line arguments. This allows for unrestricted command execution on the host system.
[PROMPT_INJECTION]: The SKILL.md file explicitly instructs the agent to avoid reading the source code of the provided scripts before running them. This concealment tactic prevents the agent from evaluating the security implications of the tools it uses.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection attacks. 1. Ingestion points: Untrusted data enters the context through Playwright's interaction with web pages and console logs as seen in examples/element_discovery.py and examples/console_logging.py. 2. Boundary markers: No delimiters or instructions are used to separate untrusted web content from system prompts. 3. Capability inventory: The scripts/with_server.py script provides a high-privilege shell execution capability. 4. Sanitization: There is no evidence of input validation or sanitization for data retrieved from external URLs.

webapp-testing