The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The file scripts/with_server.py utilizes subprocess.Popen(shell=True) to execute arbitrary strings provided via the --server command-line argument. This allows for arbitrary command injection or execution within the host environment.
[PROMPT_INJECTION] (MEDIUM): SKILL.md contains a specific directive: "DO NOT read the source until you try running the script first". This is an adversarial instruction pattern intended to prevent the AI agent from performing security analysis on the script's code before execution.
[DATA_EXFILTRATION] (MEDIUM): examples/static_html_automation.py utilizes file:// URLs to load local files into the Playwright browser. This capability allows the browser to read sensitive local filesystem data, which could be exfiltrated if combined with network requests to external domains.
[COMMAND_EXECUTION] (MEDIUM): scripts/with_server.py also executes trailing command-line arguments using subprocess.run(), which provides an additional vector for executing arbitrary system commands.
[PROMPT_INJECTION] (LOW): The skill is highly susceptible to Indirect Prompt Injection (Category 8).
Ingestion points: page.content() and DOM inspection in SKILL.md and element_discovery.py ingest untrusted data from web pages.
Boundary markers: None present; instructions do not advise the agent to ignore embedded instructions in the web content.
Capability inventory: The skill has high-privilege shell access via scripts/with_server.py.
Sanitization: No sanitization or validation of the ingested HTML/DOM content is performed before it is processed by the agent.

webapp-testing