The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True (line 74) to execute server commands provided via the --server argument. It also uses subprocess.run (line 91) to execute automation scripts. While these are intended for starting local development environments (e.g., npm run dev), they grant the agent the capability to execute arbitrary shell commands.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it ingests untrusted data from external or local web pages.
Ingestion points: Browser console logs are captured in examples/console_logging.py (line 15), and page content/element text is retrieved in examples/element_discovery.py (lines 13, 20, 27).
Boundary markers: None are present in the instructions to help the agent distinguish between its instructions and the data retrieved from the web pages.
Capability inventory: The agent can perform shell command execution via scripts/with_server.py and write files to the /mnt/user-data/outputs/ directory as seen in examples/console_logging.py.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved via Playwright before it is processed or stored.

webapp-testing