The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py utilizes subprocess.Popen with shell=True to launch server processes. This allows the agent to execute arbitrary shell strings, including those containing command separators (e.g., &&, ;). Additionally, the script uses subprocess.run() to execute a user-defined command after the servers are ready.
[INDIRECT_PROMPT_INJECTION]: The skill's core workflow, defined in the "Reconnaissance-Then-Action" pattern, involves the agent reading and interpreting live data from web applications (via page.content(), screenshots, and element inspection). This presents an attack surface where instructions embedded in a website could attempt to influence the agent's next steps.
Ingestion points: page.content(), button.inner_text(), and page.screenshot() as described in SKILL.md and utilized in examples/element_discovery.py and examples/console_logging.py.
Boundary markers: The instructions do not provide explicit boundary markers or warnings to the agent to ignore potentially malicious instructions found within the web content being tested.
Capability inventory: The skill allows for arbitrary shell command execution via scripts/with_server.py and file writing capabilities as shown in the examples (e.g., writing to /mnt/user-data/outputs/).
Sanitization: There is no evidence of sanitization or filtering applied to the web content before it is processed by the agent's logic.
[DYNAMIC_EXECUTION]: The skill is designed around the agent dynamically generating and executing Python scripts using the Playwright library to interact with local web services.

webapp-testing