The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen(shell=True) to execute server commands and subprocess.run() for testing commands. This provides a direct path for arbitrary command execution on the host system if the input strings are manipulated.
[PROMPT_INJECTION]: Documentation in SKILL.md explicitly instructs the agent to 'DO NOT read the source' of the scripts before running them. This directive discourages the agent from performing its usual role of verifying and understanding the code it interacts with, which could be used to mask malicious behavior.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection.
Ingestion points: examples/element_discovery.py and examples/console_logging.py read DOM content and console logs from web applications being tested.
Boundary markers: Absent. No instructions or delimiters are provided to the agent to ignore instructions found within the tested web content.
Capability inventory: Includes arbitrary shell command execution via with_server.py and filesystem writes for logs and screenshots.
Sanitization: Absent. Content retrieved via Playwright is processed by the agent without any sanitization or escaping.

webapp-testing