The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py utilizes subprocess.Popen(shell=True) to execute server commands provided via the --server CLI argument. This is intended to support complex shell commands (e.g., cd backend && npm start), but it grants the agent the ability to execute arbitrary shell commands on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the data it processes during testing. The agent is instructed to inspect rendered DOM content (page.content()), locator results, and console logs from the applications it interacts with (evidence in examples/element_discovery.py and examples/console_logging.py). If the web application being tested contains malicious instructions in its HTML or logs, the agent may follow them.
Ingestion points: page.content(), page.locator().all(), and page.on('console', ...) listeners in Playwright scripts.
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore instructions embedded in the web content.
Capability inventory: Arbitrary shell command execution via scripts/with_server.py and the ability to generate and execute new Python scripts.
Sanitization: Absent. The content read from the browser is used directly to inform agent decisions.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that discourage the agent from reading the source code of its helper scripts ("DO NOT read the source until you try running the script first"). While presented as a context-saving optimization, this reduces the agent's ability to verify the safety of the code it executes.

webapp-testing