The Agent Skills Directory

[COMMAND_EXECUTION]: The utility script scripts/with_server.py is designed to execute arbitrary shell commands to start servers and run automation tasks. It uses subprocess.Popen(shell=True) and subprocess.run() on arguments passed directly to the script, which could be exploited if an attacker can influence the command-line arguments.
Evidence: File scripts/with_server.py uses subprocess.Popen(server['cmd'], shell=True) and subprocess.run(args.command) where both variables are derived from user-supplied arguments.
[DATA_EXFILTRATION]: The example script examples/static_html_automation.py demonstrates the ability to automate interactions with local files using the file:// protocol. This capability can be misused to read sensitive system files if the agent is directed to an unintended path.
Evidence: File examples/static_html_automation.py: file_url = f'file://{html_file_path}' followed by page.goto(file_url).
[PROMPT_INJECTION]: The skill is intended to scrape and process content from external websites, which serves as an ingestion point for untrusted data. This makes the agent vulnerable to indirect prompt injection attacks where instructions hidden on a webpage could influence the agent's behavior.
Ingestion Points: examples/element_discovery.py and examples/console_logging.py navigate to external URLs and extract text or console logs.
Boundary Markers: None identified; the scripts do not use delimiters or instructions to ignore embedded commands in the scraped content.
Capability Inventory: The agent has the ability to execute shell commands via scripts/with_server.py and read/write local files.
Sanitization: No sanitization or validation is performed on the data extracted from the browser before it is processed or printed.

Browser Automation Expert