The Agent Skills Directory

[COMMAND_EXECUTION]: The utility scripts/with_server.py uses subprocess.Popen(shell=True) to execute the command string provided in the --server argument. This allows for arbitrary shell command execution and is a high-risk pattern if the input contains unsanitized user-provided data.
[COMMAND_EXECUTION]: The same script uses subprocess.run to execute arbitrary trailing command-line arguments as a subprocess, granting the agent broad execution capabilities.
[PROMPT_INJECTION]: The skill provides an attack surface for Indirect Prompt Injection by ingesting untrusted data from web pages and console logs.
Ingestion points: examples/element_discovery.py extracts element text, and examples/console_logging.py captures browser console messages.
Boundary markers: None; external content is interpolated directly into the agent's context without delimiters.
Capability inventory: The skill allows execution of arbitrary shell commands via its helper scripts.
Sanitization: No sanitization or safety filtering is performed on the data retrieved from the browser.
[PROMPT_INJECTION]: The documentation in SKILL.md explicitly instructs the agent not to read the source code of the provided scripts unless absolutely necessary, claiming they are 'very large'. This is a deceptive instruction as the scripts are relatively small, and it effectively discourages the agent from identifying insecure implementation details like shell=True.

webapp-testing