The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/with_server.py utility uses subprocess.Popen with shell=True to run server start commands. While this is a core feature for server lifecycle management (e.g., supporting cd and &&), it facilitates arbitrary shell command execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests DOM content from web pages, creating a vulnerability surface where malicious web content could influence agent behavior.
Ingestion points: page.content() and page.locator().all() as described in SKILL.md and demonstrated in examples/element_discovery.py.
Boundary markers: Absent. No instructions are provided to the agent to treat page content as untrusted.
Capability inventory: The agent has the ability to write files (e.g., screenshots and console logs) and execute shell commands through the with_server.py script.
Sanitization: Absent. There is no mention of sanitizing or filtering the DOM content before the agent processes it.
[DYNAMIC_EXECUTION]: The primary workflow of the skill relies on the agent dynamically writing and executing native Python Playwright scripts to perform testing tasks.
[METADATA_POISONING]: The SKILL.md instructions explicitly advise the agent to "DO NOT read the source" of the provided helper scripts unless absolutely necessary. This guidance can be used as a concealment tactic to prevent the agent from auditing the script's actual behavior.

webapp-testing