The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py is designed to execute arbitrary shell commands provided as arguments. It uses subprocess.Popen with shell=True to start servers and subprocess.run to execute automation commands. While this is the intended purpose of the tool to support complex startup sequences (e.g., using cd or &&), it provides a significant surface for command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it instructs the agent to read and act upon untrusted data from local or remote web applications.
Ingestion points: Data enters the agent context via page.content(), page.locator(...).all(), and browser console logs in examples/element_discovery.py and examples/console_logging.py.
Boundary markers: No delimiters or warnings to ignore embedded instructions are used when processing page content.
Capability inventory: The agent has the capability to execute arbitrary shell commands via the scripts/with_server.py utility.
Sanitization: There is no evidence of sanitization or validation of the ingested web content before it is processed by the agent.

webapp-testing