The Agent Skills Directory

[COMMAND_EXECUTION]: The provided Python utility scripts/with_server.py uses subprocess.Popen with shell=True to execute server start commands provided as command-line arguments. This pattern facilitates arbitrary command execution and could be exploited if an attacker manages to influence the arguments passed to the script, particularly in automated or agent-driven workflows.
[PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external web content using playwright-cli snapshot and Browser-Use's browser_get_state. This creates a significant surface for indirect prompt injection attacks, where malicious content on a web page could attempt to subvert the agent's instructions.
Ingestion points: Browser interaction tools fetch DOM and accessibility tree data in SKILL.md and reference/browser-use-tools.md.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are implemented when processing page content.
Capability inventory: The skill utilizes Bash for shell operations, allows JavaScript evaluation within the browser context via playwright-cli eval, and performs file system operations for screenshots and traces.
Sanitization: There is no evidence of filtering or sanitization of external content before it is processed by the agent's logic.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends installing global packages such as @playwright/mcp and k6. These are well-known tools from established providers (Microsoft and Grafana respectively) and are used for their intended purposes in development and testing environments.

browser-testing