The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to run server commands passed via the --server parameter. This functionality allows for the execution of complex shell commands, including those involving pipes and directory changes, which presents a security risk if the input is not strictly controlled.
[DYNAMIC_EXECUTION]: The with_server.py utility invokes subprocess.run() on the trailing arguments provided to the script. This enables the agent to execute any script or binary on the host system as part of the automated workflow.
[INDIRECT_PROMPT_INJECTION]: The skill extracts content from rendered web applications, creating a surface for instructions embedded in web pages to influence the agent.
Ingestion points: Text and HTML content extracted via Playwright calls like page.content() and button.inner_text(), as shown in SKILL.md and examples/element_discovery.py.
Boundary markers: There are no explicit delimiters or instructions to treat page content as untrusted data.
Capability inventory: The skill has access to shell execution via with_server.py and can write to the local file system in /mnt/user-data/outputs/.
Sanitization: The skill lacks any mechanism to filter or sanitize the content extracted from web applications before it is added to the agent's context.

webapp-testing