The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided via the --server flag. It also uses subprocess.run to execute trailing commands provided by the user/agent. While intended for managing local development servers, this pattern allows for arbitrary shell command execution.
Evidence (scripts/with_server.py):
process = subprocess.Popen(server['cmd'], shell=True, ...)
result = subprocess.run(args.command)
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external local web applications, which may contain untrusted content capable of influencing the agent's behavior.
Ingestion points: The skill uses Playwright to capture page.content() and console logs (page.on('console', ...)), which are then analyzed by the agent or saved to files (e.g., examples/console_logging.py, examples/element_discovery.py).
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard embedded instructions within the processed HTML or log content.
Capability inventory: The skill possesses the capability to execute shell commands (via scripts/with_server.py) and write files to the local filesystem (e.g., /mnt/user-data/outputs/).
Sanitization: There is no evidence of sanitization or filtering of the captured web content before it is processed or stored.

webapp-testing