The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions that discourage the agent from reviewing the source code of the provided scripts (DO NOT read the source until you try running the script first). While justified by context window limitations, this promotes the execution of 'black-box' logic without safety verification.
[COMMAND_EXECUTION]: The scripts/with_server.py script uses subprocess.Popen with shell=True to execute commands passed via the --server argument. It also uses subprocess.run to execute trailing command arguments. This utility is designed to run arbitrary shell commands to manage server lifecycles.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted data from web applications, creating a surface for indirect prompt injection.
Ingestion points: The agent is instructed to use page.content(), page.screenshot(), and console log listeners (page.on('console', ...) in examples/console_logging.py) to inspect web applications.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the ingested web content are provided.
Capability inventory: The agent has the capability to write and execute Python scripts, perform browser automation (Playwright), and execute shell commands via scripts/with_server.py.
Sanitization: There is no evidence of sanitization or validation of the web content (DOM, logs) before the agent processes it to determine its next steps.
[EXTERNAL_DOWNLOADS]: The skill instructions include playwright install chromium, which downloads browser binaries from official sources to support the Playwright library.

testing-webapps