The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen(shell=True) to execute commands provided via the --server CLI argument. This pattern allows for arbitrary shell command execution and is vulnerable to command injection if input parameters are influenced by untrusted data.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from web pages and browser logs. (1) Ingestion points: Content is ingested via page.content() in the reconnaissance pattern and inner_text() in examples/element_discovery.py, while examples/console_logging.py captures browser console messages. (2) Boundary markers: No delimiters or specific instructions are provided to the agent to treat this ingested content as untrusted data. (3) Capability inventory: The skill can execute shell commands and perform file system operations. (4) Sanitization: No sanitization or filtering is performed on the ingested web content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The SKILL.md instructions explicitly advise the agent to execute scripts without reading their source code first ('DO NOT read the source until you try running the script first'), which is a security-avoidant practice that increases the likelihood of executing malicious or unintended code hidden in the provided scripts.

webapp-testing