The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py is designed to execute arbitrary shell commands provided as arguments.
Evidence: Uses subprocess.Popen(server['cmd'], shell=True, ...) to launch server processes and subprocess.run(args.command) to execute user-defined automation tasks.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of untrusted data from external web applications, which can be combined with its shell execution capabilities.
Ingestion points: The agent is instructed to use Playwright to fetch page.content(), capture page.screenshot(), and monitor page.on("console", ...) logs (see examples/console_logging.py and examples/element_discovery.py).
Boundary markers: None present. The instructions do not advise the agent to treat discovered web content as untrusted data.
Capability inventory: The skill provides a wrapper for shell command execution (scripts/with_server.py) and file writing (examples/console_logging.py).
Sanitization: No sanitization or validation of data extracted from the browser is performed before potential use in subsequent logic.
[OBFUSCATION]: The skill instructions contain a directive to prevent the agent from inspecting the source code of the tools it uses.
Evidence: SKILL.md states, "DO NOT read the source until you try running the script first... These scripts can be very large and thus pollute your context window. They exist to be called directly as black-box scripts rather than ingested into your context window."
Impact: While framed as a performance optimization, this instruction discourages the agent from verifying the safety of the scripts before execution.

webapp-testing