The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted content from web applications.
Ingestion points: The skill uses page.content() and page.locator().all() to ingest data from the DOM of a target web application (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters to tell the agent to ignore instructions embedded in the processed web content (SKILL.md).
Capability inventory: The skill has access to the Bash, Write, and Edit tools, allowing it to execute commands or modify files based on potentially malicious input (SKILL.md).
Sanitization: No sanitization or validation of the ingested web content is performed before use (SKILL.md).
[COMMAND_EXECUTION]: The skill provides instructions for executing shell commands to run test suites and debug browser sessions.
Evidence: Instructions provided for running python -m pytest and using PWDEBUG=1 to launch debuggers via the Bash tool (SKILL.md).
[CREDENTIALS_UNSAFE]: Code examples in the documentation include hardcoded placeholder credentials.
Evidence: The form testing section includes a hardcoded dummy credential password='secret123' (SKILL.md).

webapp-testing