The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute arbitrary strings provided as server commands. It also uses subprocess.run to execute the main automation command. This allows the execution of arbitrary shell commands within the environment.
[PROMPT_INJECTION]: The SKILL.md file explicitly instructs the AI agent to avoid reading the source code of the provided scripts before execution ('DO NOT read the source until you try running the script first'). This instruction discourages auditing of the script's logic, such as the use of shell=True or other potentially dangerous operations, before they are run.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it is designed to ingest and process content from web applications.
Ingestion points: Untrusted data enters the context through browser console logs (msg.text), rendered page content (page.content()), and DOM element text (inner_text) via Playwright.
Boundary markers: No delimiters or instructions are present to warn the agent to ignore instructions embedded within the retrieved web content.
Capability inventory: The agent has the capability to execute arbitrary shell commands via scripts/with_server.py and write files to the local system.
Sanitization: There is no evidence of sanitization or validation of the data scraped from web pages before it is processed by the agent.

webapp-testing