The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute arbitrary shell commands provided via the --server command-line argument. While intended for starting development servers (e.g., 'npm run dev'), this mechanism allows for the execution of any shell command on the host system.
[COMMAND_EXECUTION]: The scripts/with_server.py utility also executes a user-specified command using subprocess.run(), which provides a second vector for arbitrary command execution.
[DATA_EXFILTRATION]: The scripts/api_test.py tool allows the agent to make arbitrary HTTP requests (GET, POST, PUT, DELETE, PATCH) with custom headers and body content to any URL. This capability can be leveraged to exfiltrate local data or configuration to an attacker-controlled external server.
[DATA_EXFILTRATION]: The scripts/test_webapp.py script uses Playwright to interact with any provided URL. This can be used for Server-Side Request Forgery (SSRF) to probe internal network services or to send data to external endpoints via browser interactions.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it processes content from untrusted external or local web pages which could contain malicious instructions.
Ingestion points: scripts/smoke_test.py and scripts/test_webapp.py retrieve and parse text, links, and titles from external web pages.
Boundary markers: No delimiters or instructions are used to separate page content from agent instructions.
Capability inventory: The skill includes scripts for arbitrary shell command execution (scripts/with_server.py), file system writes (screenshots/logs), and network operations.
Sanitization: No sanitization or validation is performed on the content fetched from target URLs before processing logic (such as text checks) occurs.

webapp-testing