The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py is designed to execute arbitrary shell commands provided via the --server CLI argument using subprocess.Popen(shell=True). While intended for starting development servers, this provides a direct path for the agent to execute unverified shell strings.
[COMMAND_EXECUTION]: The SKILL.md file contains instructions explicitly telling the agent: "DO NOT read the source until you try running the script first" and to use scripts as "black boxes." This instruction discourages the agent from performing security self-inspection on the code it executes.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection due to the processing of untrusted web content.
Ingestion points: The skill extracts information from external web pages using page.content(), page.locator().all(), and page.on("console", ...) (found in SKILL.md and examples/console_logging.py).
Boundary markers: There are no markers or delimiters used to separate untrusted content from the agent's instruction context.
Capability inventory: The agent has access to powerful shell execution capabilities through scripts/with_server.py and standard library access to subprocess and the file system.
Sanitization: The skill lacks any logic to sanitize or filter content retrieved from web pages before it is processed by the agent's reasoning engine.

webapp-testing