The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to run commands provided via the --server argument.
Evidence: Line 106 in scripts/with_server.py calls subprocess.Popen(cmd, shell=True, ...).
Risk: This pattern allows for shell command injection if the command string is constructed from untrusted input or if the agent is manipulated into executing unintended commands as a 'server'.
[PROMPT_INJECTION]: The skill documentation encourages using Playwright MCP tools to monitor browser console messages and network requests for failures.
Evidence: references/playwright-mcp-cheatsheet.md recommends using mcp__playwright__browser_console_messages and mcp__playwright__browser_network_requests to catch 'silent' failures.
Ingestion points: Browser console output, network headers, and response bodies from potentially untrusted websites.
Capability inventory: The agent can execute shell commands via scripts/with_server.py and interact with the file system.
Risk: This creates an indirect prompt injection surface where a malicious website could output specific strings to the console or network logs designed to override the agent's instructions or trigger dangerous tool usage.

playwright-testing