The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py executes arbitrary commands using the system shell.
Evidence: The script uses subprocess.Popen(server['cmd'], shell=True, ...) where the command string is derived directly from the --server CLI argument.
[METADATA_POISONING]: The documentation includes instructions that encourage the agent to bypass security review of the provided code.
Evidence: SKILL.md contains the following instruction: "Don't read the source until the script has been run... They exist to be called directly as black boxes." This is a concealment pattern that reduces the agent's ability to detect malicious logic in the scripts before they are invoked.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external or local web applications, creating a vulnerability surface for indirect instructions.
Ingestion points: page.content() and console log capture in examples/console_logging.py.
Boundary markers: None identified in the prompt templates or instructions.
Capability inventory: The skill has the ability to execute arbitrary shell commands via scripts/with_server.py and write files to the /tmp/ directory.
Sanitization: No sanitization or safety delimiters are applied to the captured web content or console logs before they are processed by the agent.

webapp-testing