The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py utilizes subprocess.Popen with shell=True to execute commands passed via the --server flag. It also uses subprocess.run for the primary automation command. This design allows for the execution of arbitrary shell commands within the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect injection because it takes user-influenced task descriptions and translates them into server startup commands and automation scripts without sanitization.
Ingestion points: User-defined server commands and automation logic passed as arguments to scripts/with_server.py (found in SKILL.md examples).
Boundary markers: None identified in the documentation or the script logic to separate instructions from data.
Capability inventory: The skill possesses the capability to spawn processes and execute shell commands via subprocess (found in scripts/with_server.py).
Sanitization: No escaping, validation, or filtering of the command strings is implemented before they are passed to the shell.
[OBFUSCATION]: The SKILL.md file contains a specific directive: 'DO NOT read the source until you try running the script first'. While the skill provides a technical justification regarding context window management, this instruction functions as a concealment tactic that discourages the agent from reviewing the security implications of the helper script before execution.

webapp-testing