The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided via the --server argument. This enables the execution of arbitrary shell commands without validation or sanitization. Additionally, the SKILL.md instructions discourage the agent from reading the script source code before execution, which promotes the blind use of these dangerous capabilities.
[DYNAMIC_EXECUTION]: The scripts/with_server.py script facilitates the runtime execution of arbitrary command strings constructed dynamically from command-line arguments, which is used to manage server lifecycles but lacks safety constraints.
[INDIRECT_PROMPT_INJECTION]: The skill implements a 'Reconnaissance-Then-Action' pattern that ingests untrusted content from web pages to determine future actions. This creates an attack surface where malicious instructions embedded in a web application's DOM could compromise the agent.
Ingestion points: Data enters the context via page.content(), DOM element inspection, and full-page screenshots in SKILL.md and examples/element_discovery.py.
Boundary markers: Absent. There are no instructions or delimiters defined to prevent the agent from following commands found within the analyzed web content.
Capability inventory: The agent has access to arbitrary shell command execution through scripts/with_server.py and local file writing capabilities through Playwright screenshots.
Sanitization: Absent. No filtering, escaping, or validation is performed on the web content before it is processed by the agent.

webapp-testing