The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py implements a wrapper for executing arbitrary shell commands provided via command-line arguments.
It utilizes subprocess.Popen with shell=True to launch server processes defined by the --server flag.
It uses subprocess.run() to execute the main automation command provided by the user/agent.
The instructions in SKILL.md advise the agent to treat these scripts as "black boxes," which could potentially lead the agent to execute unverified or malicious shell commands if it receives a compromised task description.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates interaction with dynamic web applications, creating a vulnerability surface where untrusted data could influence agent behavior.
Ingestion points: The agent is instructed to read HTML, inspect the DOM via page.content(), and use page.locator().all() to discover elements in element_discovery.py and SKILL.md.
Boundary markers: The instructions do not provide delimiters or warnings to ignore instructions that might be embedded in the HTML or console logs of the application being tested.
Capability inventory: The skill provides capabilities to write files (screenshots and logs) and execute shell commands via the with_server.py script.
Sanitization: There is no evidence of filtering or validation of the content retrieved from the web pages before the agent uses it to decide on subsequent actions.

webapp-testing