The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py is designed to execute arbitrary shell commands provided via arguments.
Evidence: It uses subprocess.Popen(server['cmd'], shell=True) to start server processes and subprocess.run(args.command) for automation tasks.
Context: While intended for legitimate development tasks like starting servers (e.g., 'npm run dev'), the use of shell=True on command strings provided by the agent represents a powerful capability that can be abused if the agent is misled by external data.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by instructing the agent to ingest and act upon data from external web applications.
Ingestion points: Web page content, DOM structure, and browser console log messages (see examples/element_discovery.py and examples/console_logging.py).
Boundary markers: The instructions do not provide delimiters or 'ignore embedded instructions' warnings for the data ingested from the browser.
Capability inventory: The agent has access to file writing (logs and screenshots), network operations (via Playwright), and arbitrary command execution (via scripts/with_server.py).
Sanitization: No sanitization or validation logic is present to filter malicious instructions embedded in the tested web pages or logs.

webapp-testing