The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that explicitly tell the agent not to prioritize reading the source code of its own helper scripts (切分行为——“勿优先读源码”). This directive discourages security transparency and encourages the agent to execute potentially complex logic as a "black box," which could hide malicious behavior in referenced scripts.
[COMMAND_EXECUTION]: The instructions demonstrate a workflow involving scripts/with_server.py which takes arbitrary shell command strings as arguments (e.g., --server "npm run dev") and executes them to manage service lifecycles. This provides a direct interface for shell command execution.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external or local web applications, creating a vulnerability surface where malicious instructions in a web page could influence the agent's actions.
Ingestion points: Browser DOM content, HTML source code, and visual screenshots retrieved via Playwright (page.content(), page.screenshot()).
Boundary markers: Absent; the agent is instructed to "Directly read HTML" to determine selectors and next steps without specific delimiters or isolation instructions for the untrusted content.
Capability inventory: The skill has the ability to execute arbitrary shell commands (via the with_server.py wrapper) and write files to the system (via screenshots).
Sanitization: None; there is no mention of filtering, escaping, or validating the ingested web content before the agent uses it to decide on subsequent browser interactions or command executions.

webapp-testing