The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py executes arbitrary shell commands provided via the --server argument using subprocess.Popen with shell=True. It also executes the trailing command using subprocess.run. While intended for managing server lifecycles during testing, this creates a vector for command injection if inputs are not properly sanitized by the agent.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves the agent ingesting untrusted data from external web applications to identify UI selectors and determine testing logic.
Ingestion points: The agent is instructed to read HTML content, take screenshots, and inspect the rendered DOM (documented in SKILL.md).
Boundary markers: None. There are no instructions to ignore malicious directives embedded in the HTML or DOM content.
Capability inventory: The agent has the ability to execute shell commands (via with_server.py) and write/execute local Python scripts.
Sanitization: None. The agent uses raw output from the browser state to form its next actions and script logic.
[DYNAMIC_EXECUTION]: The instructions in SKILL.md guide the agent to dynamically generate and execute Python Playwright scripts based on the reconnaissance of the target web application. This runtime code generation is a standard feature of the skill but increases the risk if the reconnaissance data is malicious.
[OBFUSCATION]: The instructions in SKILL.md explicitly tell the agent "DO NOT read the source" of the helper scripts until absolutely necessary, citing context window concerns. This encourages the agent to treat provided scripts as black boxes, reducing transparency during execution.

webapp-testing