The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/with_server.py helper script uses subprocess.Popen with shell=True to execute server startup commands. While designed to manage server lifecycles, this pattern allows for the execution of arbitrary shell commands (e.g., command chaining with && or ;) if the input is not strictly controlled.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and test local web applications using Playwright. It implements a 'Reconnaissance-Then-Action' pattern where the agent is instructed to read HTML content, inspect the DOM, and identify selectors to drive its next actions. This creates an attack surface where a malicious or compromised web application could include hidden instructions within its DOM (e.g., in invisible elements or comments) that influence the agent's behavior during the testing process.
Ingestion points: The agent reads external content via page.content(), page.locator().all(), and page.screenshot() in SKILL.md and examples/element_discovery.py.
Boundary markers: None are specified to separate the data being tested from the agent's instructions.
Capability inventory: The agent has the capability to execute shell commands via scripts/with_server.py and write files to the system via examples/console_logging.py.
Sanitization: No sanitization or validation of the processed DOM content is performed before the agent uses it to decide on further actions.

webapp-testing