The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of playwright via pip install and playwright install chromium. These are well-known, legitimate tools from a well-known service (GitHub/Microsoft) and are considered safe practice for the stated purpose.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to install dependencies and run browser installation scripts.
[INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection because it reads and processes external, potentially untrusted data.
Ingestion points: The agent is instructed to use page.content(), page.screenshot(), and monitor console logs to inspect the rendered DOM and identify interactive elements (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters mentioned to isolate web content from the agent's internal instructions or to warn the agent to ignore embedded instructions in the web application's HTML.
Capability inventory: The skill has the capability to write files (page.screenshot), install packages (pip install), and execute arbitrary Python code as part of the testing workflow.
Sanitization: No sanitization or filtering of the ingested web content is described before the agent uses it to decide on subsequent actions.

webapp-testing