The Agent Skills Directory

[PROMPT_INJECTION]: The documentation in SKILL.md explicitly instructs the agent to avoid reading the source code of helper scripts before executing them. It uses phrases like "DO NOT read the source until you try running the script first" and "These scripts exist to be called directly as black-box scripts rather than ingested into your context window," which discourages the agent from verifying the safety of the code it runs.
[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to run commands passed via the --server argument. This is a common pattern for shell injection vulnerabilities if the command strings are not strictly validated.
[DATA_EXFILTRATION]: Example scripts (examples/console_logging.py, examples/element_discovery.py, examples/static_html_automation.py) save screenshots and log files to paths such as /tmp/ and /mnt/user-data/outputs/. While functional, this demonstrates the ability to write to the local filesystem.
[PROMPT_INJECTION]: The skill implements a pattern for reading and interacting with web page content (e.g., page.content(), button.inner_text()). This creates an attack surface for indirect prompt injection where a malicious web application could provide instructions to the agent through the rendered DOM.
Ingestion points: Content is ingested via Playwright locators and content capture in SKILL.md and examples/element_discovery.py.
Boundary markers: No specific delimiters or instructions are provided to the agent to ignore instructions embedded within the web applications being tested.
Capability inventory: The skill has the capability to execute shell commands and interact with the filesystem via scripts/with_server.py and the Playwright examples.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from the web applications before it is processed by the agent.

webapp-testing