The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided via the --server argument. While intended to support complex shell commands (e.g., using && or cd), this enables shell metacharacter execution for any string passed to the server parameter.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection as it is designed to ingest and process untrusted data from web pages and console logs.
Ingestion points: The agent is instructed to use page.content(), page.locator().all(), and capture console logs to identify selectors and debug behavior (referenced in SKILL.md and examples/console_logging.py).
Boundary markers: No specific delimiters or instructions to ignore embedded commands in the processed web content are provided.
Capability inventory: The agent has the capability to write files and execute arbitrary Python scripts and shell commands (scripts/with_server.py, subprocess.run).
Sanitization: No evidence of sanitization or validation of the ingested web content before it is used to influence the agent's next steps.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that discourage the agent from auditing the provided scripts: "DO NOT read the source until you try running the script first... They exist to be called directly as black-box scripts." This is framed as a context-window optimization, but it functions as a concealment pattern that discourages the AI from identifying potential issues in the tools it executes.
[DYNAMIC_EXECUTION]: The primary operational mode of this skill involves the agent dynamically generating and executing Python scripts (Playwright automations). While standard for this use case, it requires high trust in the agent's ability to generate safe code.

webapp-testing