The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script scripts/with_server.py is designed to execute arbitrary shell commands provided through its arguments (e.g., using the --server flag). It utilizes subprocess.Popen with shell=True to support complex shell strings including directory changes and command chaining. While functional for its intended purpose of starting dev servers, this provides a direct mechanism for shell command execution.
[INDIRECT_PROMPT_INJECTION]: The skill enables the agent to browse and interact with web applications, capturing element text, DOM content, and console logs. This untrusted data is then ingested into the agent's context.
Ingestion points: examples/element_discovery.py (extracts inner text from buttons and links), examples/console_logging.py (captures browser console messages).
Boundary markers: No delimiters or "ignore instructions" warnings are used when processing the captured web content.
Capability inventory: The agent has the capability to execute shell commands via scripts/with_server.py and run local Python scripts.
Sanitization: There is no evidence of sanitization or filtering applied to the captured web content before it is processed by the agent.
[PROMPT_INJECTION]: The instructions in SKILL.md include a concealment pattern, explicitly telling the agent "DO NOT read the source until you try running the script first". Although framed as a way to optimize context window usage, this encourages the agent to execute the provided scripts blindly without verifying their internal logic.

webapp-testing