The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py utilizes subprocess.Popen(shell=True) to execute server commands provided via the --server argument. It also uses subprocess.run to execute the primary automation command. This design grants the agent the ability to execute arbitrary shell commands on the host system.
[DYNAMIC_EXECUTION]: The skill's workflow relies on the runtime generation and execution of Python Playwright scripts and shell commands to manage local development servers.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to navigate, inspect, and scrape content from web applications. This creates a significant attack surface where a malicious web page could inject instructions aimed at the agent.
Ingestion points: Web page content, DOM selectors, and console logs are read into the agent's context through scripts like examples/element_discovery.py and examples/console_logging.py.
Boundary markers: The skill lacks instructions or mechanisms for using delimiters or protective prompts to prevent the agent from obeying instructions embedded in the target application's data.
Capability inventory: The agent has the capability to write files (as seen in examples/console_logging.py) and execute shell commands (via scripts/with_server.py).
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the web browser before it is processed by the agent.
[OBFUSCATION]: The SKILL.md file contains instructions that explicitly discourage the agent from reading the source code of the provided scripts ("DO NOT read the source until you try running the script first"). While framed as a context-management optimization, this practice can hide the implementation details of high-risk functions like subprocess.Popen(shell=True) from the agent's oversight.

webapp-testing