The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py executes system commands to start web servers and run test automation.
Evidence: The script uses subprocess.Popen and subprocess.run to manage processes.
Safety Controls: The script implements several security measures:
An allowlist of permitted executables (e.g., npm, python, playwright, pytest).
A validation routine that checks for and rejects shell metacharacters (e.g., ;, &&, |, `, $()) in command arguments.
Path resolution logic in safe_working_directory to ensure working directory changes do not escape the project root.
[PROMPT_INJECTION]: The skill instructions in SKILL.md are focused on operational guidance and context window optimization.
Evidence: While the skill advises the agent not to read the source code unless necessary to save context space, the logic remains transparent, and there are no instructions to bypass safety filters or override system constraints.
[DATA_EXPOSURE]: The skill performs local network operations to verify server availability.
Evidence: The is_server_ready function in scripts/with_server.py uses socket.create_connection to poll localhost ports. This is standard behavior for a development tool and does not involve external data exfiltration or access to sensitive credential files.

webapp-testing