The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute commands provided via the --server argument. While intended for starting local development servers (e.g., npm run dev), this allows for the execution of arbitrary shell commands and is susceptible to command injection if untrusted input is passed to the script.
Evidence in scripts/with_server.py: process = subprocess.Popen(server['cmd'], shell=True, ...) where server['cmd'] is derived directly from the --server CLI argument.
[COMMAND_EXECUTION]: The script scripts/with_server.py executes a trailing command using subprocess.run(args.command). While not using shell=True, it still executes arbitrary processes based on user input.
Evidence in scripts/with_server.py: result = subprocess.run(args.command).
[DATA_EXFILTRATION]: The example examples/console_logging.py records browser console logs and saves them to /mnt/user-data/outputs/console.log. If the web application being tested processes sensitive data that is logged to the console (e.g., API keys, tokens, or PII), this could lead to data exposure.
Evidence in examples/console_logging.py: with open('/mnt/user-data/outputs/console.log', 'w') as f: f.write('\n'.join(console_logs)).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from web pages (page.content(), page.locator('button').all()) to identify selectors. This is a standard vector for indirect prompt injection if the target web page contains malicious instructions intended to manipulate the agent's behavior during the 'Reconnaissance-Then-Action' phase.
Evidence in SKILL.md: The 'Decision Tree' and 'Reconnaissance-Then-Action Pattern' sections explicitly instruct the agent to read DOM content and screenshots to determine its next actions.

webapp-testing