The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The script scripts/with_server.py executes user-provided strings from the --server argument using subprocess.Popen with shell=True. This allows for arbitrary command execution and is highly susceptible to command injection if the input contains shell metacharacters.
[PROMPT_INJECTION] (MEDIUM): The SKILL.md file contains instructions that attempt to override the agent's standard operating procedure by stating 'DO NOT read the source until you try running the script first'. This is a deceptive pattern designed to discourage the agent from inspecting potentially malicious code before execution.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill provides patterns for ingesting untrusted data from external web applications which could contain malicious instructions.
Ingestion points: examples/element_discovery.py and examples/console_logging.py (via page.content(), inner_text(), and console logs).
Boundary markers: None identified in the provided examples.
Capability inventory: File system writes (to /mnt/user-data/outputs/) and arbitrary shell execution via scripts/with_server.py.
Sanitization: None; external content is printed directly to the console or written to files.

webapp-testing