The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py is designed to execute arbitrary shell commands provided via the --server command-line argument. It uses subprocess.Popen with shell=True to support complex commands (e.g., using && or cd). If the AI agent incorporates untrusted data into these command arguments, it could lead to shell command injection.
[DYNAMIC_EXECUTION]: The skill's primary workflow involves the AI agent writing and then executing its own Python scripts using the Playwright library. This provides the agent with the capability to execute any Python code it generates, which is a significant security surface despite being the intended functionality of the toolkit.
[INDIRECT_PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because its core purpose is to ingest and analyze untrusted data from web applications. A malicious web page could contain hidden instructions designed to hijack the agent's logic during the 'Reconnaissance-Then-Action' phase.
Ingestion points: The agent is instructed to read page.content(), inspect DOM elements via page.locator().all(), and capture console logs in examples/console_logging.py.
Boundary markers: No boundary markers or 'ignore' instructions are specified for the data ingested from the browser.
Capability inventory: The agent has access to file system writes (e.g., /mnt/user-data/outputs/), network access (Playwright), and arbitrary command execution via scripts/with_server.py.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the web pages before it is processed by the AI.

webapp-testing