The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py is designed to execute arbitrary shell commands provided as command-line arguments. It uses subprocess.Popen with shell=True for server commands and subprocess.run for the primary execution command, allowing for unrestricted system command execution.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that discourage the agent from performing security reviews on the included code ('DO NOT read the source until you try running the script first'), which is an anti-analysis pattern that could facilitate the execution of malicious logic.
[PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted content from web applications via Playwright and possessing high-privilege shell access.
Ingestion points: examples/element_discovery.py reads DOM content; examples/console_logging.py captures browser console output.
Boundary markers: No delimiters or warnings are used to prevent the agent from interpreting ingested data as instructions.
Capability inventory: scripts/with_server.py provides shell execution capabilities; examples/ scripts have file-system write access.
Sanitization: No evidence of sanitization or filtering is present for data ingested from the browser before potential use in system commands.

webapp-testing