The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided via the --server flag. While this supports complex startup commands (e.g., using cd and &&), it creates a vector for command injection if the agent incorporates untrusted input into these arguments.- [COMMAND_EXECUTION]: The script scripts/with_server.py executes arbitrary trailing commands using subprocess.run(), which is its primary intended function for running automation tests.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes arbitrary content from web applications (via page.content() and DOM inspection). Ingestion points: Data enters the agent's context through Playwright's page inspection functions in examples/element_discovery.py and instructions in SKILL.md. Boundary markers: Absent; the agent is encouraged to read the DOM directly without specific instructions to ignore embedded commands. Capability inventory: The agent has the capability to execute shell commands (via scripts/with_server.py) and write/run arbitrary Python code. Sanitization: None present in the provided examples or helper scripts.- [PROMPT_INJECTION]: The SKILL.md file contains instructions explicitly telling the agent not to read the source code of the helper scripts unless absolutely necessary. While framed as a context-window optimization, this functions as a concealment pattern that discourages the agent from inspecting the underlying command execution logic.

webapp-testing