The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py utilizes subprocess.Popen(..., shell=True) to execute server start commands. The --server argument accepts arbitrary strings which are passed directly to the system shell, allowing for potential command injection. Additionally, the script executes positional arguments via subprocess.run(), which facilitates further arbitrary command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it encourages the agent to ingest untrusted data from web pages (via Playwright) and subsequently use a powerful shell execution script.
Ingestion points: Browser content is retrieved via page.content() and console logs are captured in examples/element_discovery.py and examples/console_logging.py.
Boundary markers: The instructions lack any specific boundary markers or warnings to the agent to disregard instructions embedded in the web content being tested.
Capability inventory: The script scripts/with_server.py provides a high-privilege capability to execute shell commands.
Sanitization: There is no evidence of sanitization or validation of the strings passed to the subprocess calls in the server management script.

webapp-testing