The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py facilitates arbitrary command execution. It uses subprocess.Popen with shell=True to launch server processes and subprocess.run to execute automation commands. This pattern allows the agent to execute complex shell strings, which increases the risk of command injection if arguments are not strictly controlled.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that explicitly steer the agent away from analyzing the implementation details of its own scripts ("DO NOT read the source until you try running the script first"). This discourages the agent from identifying potential security flaws like the use of shell=True in the helper scripts.
[PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing external data from local web applications.
Ingestion points: Browser console logs are captured and stored in examples/console_logging.py, and page content is processed in examples/element_discovery.py and SKILL.md.
Boundary markers: No explicit delimiters or instructions are used to distinguish untrusted web content from legitimate agent instructions.
Capability inventory: The agent has the ability to execute shell commands via the scripts/with_server.py utility script.
Sanitization: The skill lacks mechanisms to sanitize or filter captured logs and page data before they are analyzed by the agent.

webapp-testing