The Agent Skills Directory

[DYNAMIC_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands passed via the --server argument. This configuration is used to support complex shell syntax (like cd && npm start) but increases the risk of command injection if arguments are not strictly validated.
[COMMAND_EXECUTION]: The scripts/with_server.py script executes an additional command provided by the agent after the servers have started, using subprocess.run(args.command).
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it retrieves and processes live content from web applications.
Ingestion points: The scripts use page.content() and page.locator().all() in examples/element_discovery.py, and capture console logs via page.on('console', ...) in examples/console_logging.py.
Capability inventory: The skill can execute shell commands through scripts/with_server.py and write files to the /mnt/user-data/outputs/ directory.
Boundary markers: Absent; no explicit delimiters or instructions are provided to the agent to treat the captured web content as untrusted.
Sanitization: Absent; there is no filtering of the HTML content, console logs, or element text before they are ingested into the agent's context.
[METADATA_POISONING]: The documentation in SKILL.md explicitly instructs the agent not to read the source code of the scripts before execution.
Evidence: The text 'DO NOT read the source until you try running the script first' in SKILL.md discourages security review of the executable components.

webapp-testing