The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute server start commands provided via the --server argument. This allows for complex shell commands (e.g., using && or cd) but creates a sink for command injection if the agent is influenced to pass malicious strings.
[DATA_EXFILTRATION]: While intended for debugging, the skill's example scripts (examples/element_discovery.py, examples/static_html_automation.py) capture browser screenshots and save them to local paths like /tmp/ and /mnt/user-data/outputs/. The examples/console_logging.py script also saves browser console logs to the filesystem. These could potentially capture sensitive information displayed in the web application.
[PROMPT_INJECTION]: The skill instructions in SKILL.md include a directive ('DO NOT read the source until you try running the script first') that could be used to conceal tool behavior from the agent's own oversight, though it is framed as a context-window optimization.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection.
Ingestion points: Browser console logs are ingested in examples/console_logging.py (line 16), and DOM content (inner text, attributes) is ingested in examples/element_discovery.py (lines 15, 21).
Boundary markers: Absent. The scripts do not use delimiters or instructions to ignore instructions embedded in the web content.
Capability inventory: The agent has the capability to execute shell commands via scripts/with_server.py and write files to the filesystem.
Sanitization: Absent. Data read from the browser is used directly without escaping or validation.

webapp-testing