The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py executes commands provided as command-line arguments. It uses subprocess.run() to execute the main automation task and subprocess.Popen() to start background servers.
[DYNAMIC_EXECUTION]: In scripts/with_server.py, the subprocess.Popen() call uses shell=True to support shell features like command chaining (&&) and directory changes (cd). This allows the execution of arbitrary shell strings passed to the script by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading and inspecting the DOM of web applications (page.content(), page.locator().all()) and capturing console logs. This creates a surface where instructions embedded in a target web page could attempt to manipulate the agent's logic or the commands it executes through the testing utility.
Ingestion points: Browser DOM content and console logs retrieved via Playwright in examples/element_discovery.py and examples/console_logging.py.
Boundary markers: None identified in the provided scripts to distinguish between untrusted web data and agent instructions.
Capability inventory: Shell command execution via subprocess in scripts/with_server.py, and file system writes to /tmp/ and /mnt/user-data/outputs/ in the example scripts.
Sanitization: The scripts do not appear to sanitize or filter the content retrieved from the browser before it enters the agent's context window.

webapp-testing