The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen(shell=True) to execute command strings provided via the --server argument. It also uses subprocess.run() to execute the user-provided command after servers are started. This facilitates arbitrary shell command execution with the privileges of the agent.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and interact with content from web applications (e.g., using page.content() and page.locator() in examples/element_discovery.py). This creates an attack surface where maliciously crafted HTML or JavaScript content could inject instructions into the agent's context.
Ingestion points: page.content(), page.locator().all(), page.screenshot() in examples/element_discovery.py and examples/static_html_automation.py.
Boundary markers: No explicit delimiters or instructions to ignore embedded content are used when processing the data.
Capability inventory: File system writing (page.screenshot), shell command execution (scripts/with_server.py), and network operations (Playwright browser navigation).
Sanitization: The skill lacks sanitization, validation, or filtering of the ingested web content before the agent processes it.
[OBFUSCATION]: The SKILL.md file contains instructions that discourage the agent from inspecting the source code of provided scripts ("DO NOT read the source until you try running the script first"). This reduces the likelihood of the agent identifying the security implications of the shell execution logic in the helper scripts before execution.

webapp-testing