The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill interacts with external and local web content via Playwright, creating a surface for indirect prompt injection attacks where malicious instructions in HTML content or console logs could influence the agent's behavior.
Ingestion points: Browser automation scripts in examples/element_discovery.py, examples/console_logging.py, and examples/static_html_automation.py read page content, attribute values, and browser console logs.
Boundary markers: The skill does not employ delimiters or explicit instructions to ignore potentially malicious content found on web pages.
Capability inventory: The skill provides shell execution capabilities through scripts/with_server.py, which is used to launch servers and run test scripts.
Sanitization: There is no evidence of filtering or sanitization of data retrieved from the browser before it is processed by the agent.
[COMMAND_EXECUTION]: The script scripts/with_server.py is designed to execute shell commands provided as command-line arguments, which represents a capability that could be exploited.
The script uses subprocess.Popen with shell=True to execute server commands (e.g., npm run dev) and subprocess.run to execute the primary test command.
This utility is intended for managing development servers but provides a mechanism for executing arbitrary shell strings, including those with shell metacharacters and pipes.

webapp-testing