The Agent Skills Directory

[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes content from web applications that may be untrusted.
Ingestion points: The agent is instructed to read rendered DOM content and page source using page.content() and page.locator() in SKILL.md.
Boundary markers: Absent. The instructions do not include markers or warnings to ignore potential instructions embedded within the HTML of the site being tested.
Capability inventory: The agent can execute local shell commands via with_server.py and run dynamic Python scripts, creating a high-impact path if injection occurs.
Sanitization: Absent. The skill does not implement validation or escaping for the data retrieved from the browser before the agent uses it for decision-making.
[COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands provided as arguments to helper scripts.
Evidence: The documentation for scripts/with_server.py demonstrates using the --server flag to execute commands such as npm run dev or python server.py.
[REMOTE_CODE_EXECUTION]: The skill workflow requires the agent to dynamically generate and execute local Python code.
Evidence: The skill instructions guide the agent to "write native Python Playwright scripts" and execute them using the local Python interpreter to perform automation tasks.

webapp-testing