The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen(shell=True) to start local development servers and subprocess.run() to execute automation commands. While this is necessary for its intended purpose of managing server lifecycles (e.g., running npm run dev), it allows the agent to execute arbitrary shell commands.
[DYNAMIC_EXECUTION]: The skill's primary workflow involves the agent dynamically generating and executing new Python scripts using the Playwright library. This enables flexible automation but requires the agent to execute code created at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill implements a 'Reconnaissance-Then-Action' pattern where the agent navigates to web pages, inspects their content (DOM, console logs, screenshots), and uses that information to identify selectors and determine its next actions. This data is untrusted and could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The agent reads external content via page.content(), page.locator().all(), and captures browser console logs as demonstrated in examples/console_logging.py.
Boundary markers: The instructions do not specify any delimiters or safety warnings to prevent the agent from following instructions embedded in the web pages it visits.
Capability inventory: The agent has the ability to execute shell commands through scripts/with_server.py and write/execute new Python files.
Sanitization: There is no evidence of sanitization or filtering applied to the web content before the agent processes it for decision-making.

webapp-testing