The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided as CLI arguments. This allows for arbitrary shell command execution and is sensitive to shell injection if the inputs are influenced by untrusted data.- [PROMPT_INJECTION]: The SKILL.md file contains instructions that tell the agent 'DO NOT read the source until you try running the script first'. This discourages the agent from performing a safety and security review of the code it is about to execute, which is a deceptive instruction pattern.- [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it uses Playwright to navigate to and scrape content from external or local web applications. Malicious instructions embedded in these web pages could potentially influence the agent's subsequent tool calls. (1) Ingestion points: page.goto(), page.content(), and page.locator() in SKILL.md and examples/element_discovery.py. (2) Boundary markers: None present in the instructions to separate web content from agent logic. (3) Capability inventory: Arbitrary shell execution via scripts/with_server.py and file writing in examples/console_logging.py. (4) Sanitization: No evidence of sanitization or validation of the ingested web content before it is processed by the agent.

webapp-testing