The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py utilizes subprocess.Popen with shell=True and subprocess.run to execute arbitrary shell commands passed as arguments. This is intended to manage server lifecycles (e.g., npm run dev) but provides a mechanism for direct shell execution within the agent's environment.
[INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to perform 'Reconnaissance-then-action' by inspecting rendered DOM content, capturing screenshots, and reading browser console logs. This untrusted data from local or external web applications could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: page.content(), page.locator().all(), and console log listeners in examples/element_discovery.py and examples/console_logging.py.
Boundary markers: Absent; the instructions do not include specific delimiters or warnings to ignore instructions found within the processed web content.
Capability inventory: The agent has access to arbitrary shell command execution via scripts/with_server.py and file system writes (e.g., to /mnt/user-data/outputs/ and /tmp/).
Sanitization: Absent; the agent is directed to identify selectors and execute actions based on raw strings discovered during the reconnaissance phase.

webapp-testing