The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py facilitates arbitrary shell command execution. It uses subprocess.Popen with shell=True to execute commands passed through the --server CLI argument. It also executes a secondary command provided at the end of the argument list using subprocess.run. This design allows for the execution of arbitrary shell strings without sanitization.
[METADATA_POISONING]: The SKILL.md file contains instructions that explicitly discourage the agent from auditing the provided scripts ('DO NOT read the source until you try running the script first'). While justified as a method to save context window space, this concealment pattern reduces the ability of the agent to identify dangerous operations within the scripts before they are executed.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8).
Ingestion points: Untrusted data enters the agent context via Playwright when reading page content (page.content()) or capturing console logs (page.on("console", ...)).
Boundary markers: No boundary markers or instructions to ignore embedded commands are present when processing web application data.
Capability inventory: The skill has significant capabilities including arbitrary shell execution via scripts/with_server.py and file system writes for screenshots and logs.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from web applications before it might influence subsequent agent decisions.

webapp-testing