The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute strings provided via the --server command-line argument.
Evidence: The code in scripts/with_server.py directly passes the server['cmd'] string to the shell without sanitization.
Risk: This allows for arbitrary command execution, including command chaining or execution of malicious payloads if the input is manipulated.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that direct the agent to avoid reviewing the implementation details of the provided scripts.
Evidence: "DO NOT read the source until you try running the script first... These scripts can be very large and thus pollute your context window. They exist to be called directly as black-box scripts rather than ingested into your context window."
Risk: This is a concealment pattern that prevents the agent from identifying the insecure use of shell=True or other risky behaviors in the scripts before they are executed.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to the lack of boundary markers when processing untrusted web content.
Ingestion points: Data is ingested from web pages in examples/element_discovery.py via page.content() and page.locator().all(), and in examples/console_logging.py via page.on("console", ...).
Boundary markers: No delimiters or "ignore embedded instructions" warnings are present in the automation logic or instructions.
Capability inventory: The agent can execute arbitrary shell commands via the scripts/with_server.py utility.
Sanitization: There is no evidence of filtering or validation of the data retrieved from the browser before it is processed in the agent's context.

webapp-testing