The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py executes commands provided via the --server and --command CLI arguments using subprocess.Popen(..., shell=True) and subprocess.run(). This enables the execution of arbitrary shell commands in the host environment, which can be risky if input is influenced by untrusted sources.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill reads content from external web pages (DOM elements, console logs) and brings it into the agent's context without sanitization.
Ingestion points: examples/console_logging.py (line 30
captures console messages) and examples/element_discovery.py (lines 15, 18, 24
extracts DOM text and attributes).
Boundary markers: Absent. The skill does not use delimiters or instructions to treat web content as untrusted data.
Capability inventory: The skill includes shell command execution via scripts/with_server.py and file-writing capabilities in various example scripts.
Sanitization: Absent. Web content is captured and displayed or stored in its raw form.
[PROMPT_INJECTION]: The SKILL.md file contains instructions telling the agent "DO NOT read the source until you try running the script first," which acts as a concealment pattern by discouraging the agent from auditing the logic of scripts that perform shell execution.

webapp-testing