The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute server commands provided as command-line arguments. While intended to support complex startup sequences (e.g., using && and cd), this allows for arbitrary shell command execution.
[PROMPT_INJECTION]: The SKILL.md file contains instructions directing the agent to "DO NOT read the source until you try running the script first" and to use scripts as "black-box" tools. This practice discourages the agent from auditing the script's logic before execution, which could be used to conceal malicious behaviors.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the web applications being tested.
Ingestion points: Untrusted data enters the context through page.content() and page.on("console", ...) handlers in Playwright scripts referenced in SKILL.md and examples/console_logging.py.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to treat web content as potentially adversarial.
Capability inventory: The skill provides capabilities to execute shell commands via scripts/with_server.py and write to the local file system as shown in examples/element_discovery.py.
Sanitization: No sanitization or filtering is performed on the captured HTML content or browser console logs before they are processed by the agent.

webapp-testing