The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute strings provided via the --server command-line argument. This allows for the execution of arbitrary shell commands, including those involving pipes or subshells, without sanitization.
[COMMAND_EXECUTION]: The script scripts/with_server.py also uses subprocess.run to execute the final command provided as a remainder argument.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that explicitly tell the agent 'DO NOT read the source until you try running the script first' and to treat scripts as 'black-box scripts'. This discourages the agent from performing security audits of the code it executes, which is a concealment tactic.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it is designed to ingest and act upon untrusted data from web pages (e.g., via page.content(), inner_text(), and console logs). An attacker-controlled website could include instructions in these fields that influence the agent's next commands, such as providing a malicious string to the with_server.py script.
Ingestion points: Web page content (DOM), element text (buttons/links), and browser console logs are read into the agent's context from local or remote web applications.
Boundary markers: None identified; there are no instructions to the agent to disregard instructions found within the processed web data.
Capability inventory: The skill has the capability to execute arbitrary shell commands via the scripts/with_server.py utility.
Sanitization: No evidence of sanitization or validation of data extracted from the browser before it is used in decision-making or command construction.

webapp-testing