The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions that actively discourage the agent from inspecting the source code of its scripts, stating 'DO NOT read the source' and 'Use bundled scripts as black boxes'. This is a deceptive pattern designed to bypass the agent's ability to verify the security and behavior of the code it is instructed to run.
[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute server commands. This is a dangerous coding practice that facilitates arbitrary shell command execution and makes the skill vulnerable to command injection if arguments are derived from unvalidated sources.
[COMMAND_EXECUTION]: The with_server.py script is designed to execute arbitrary secondary commands provided as trailing arguments via subprocess.run, which allows the agent to trigger the execution of any local executable or script without safety constraints.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where untrusted data could influence command execution.
Ingestion points: examples/console_logging.py (captures browser console logs) and examples/element_discovery.py (extracts DOM content).
Boundary markers: Absent; there are no instructions or delimiters provided to ensure the agent ignores potentially malicious commands embedded in the web content it processes.
Capability inventory: The scripts/with_server.py script provides capabilities for arbitrary shell and command execution via Popen and run calls.
Sanitization: Absent; external content extracted from web pages is not sanitized or validated before being incorporated into the agent's workflow.

webapp-testing