The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute server startup commands provided via the --server argument. This allows for the execution of arbitrary shell commands and the use of shell features like command chaining (&&, ;), which could be abused if the input is influenced by untrusted data.
[COMMAND_EXECUTION]: The scripts/with_server.py script executes the remainder of its command-line arguments as a subprocess using subprocess.run(args.command), providing a mechanism for arbitrary command execution.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from web application interfaces and logs.
Ingestion points: The example scripts element_discovery.py and console_logging.py extract text from the DOM (button.inner_text(), link.inner_text()) and capture browser console messages (msg.text).
Boundary markers: None. The captured content is printed directly or stored in files without delimiters or instructions to the agent to ignore embedded commands.
Capability inventory: The skill environment provides the agent with capabilities to execute shell commands (via with_server.py) and write to the file system (e.g., /mnt/user-data/outputs/).
Sanitization: No sanitization or filtering of the captured web content or console logs is performed before the data is presented to the agent's context.

webapp-testing