The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute arbitrary commands passed via the --server argument. This allows for the execution of any system command, which could be exploited if an attacker can influence the input to this script.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it is designed to browse, inspect, and extract data from external web applications using Playwright. Attackers could place malicious instructions in HTML content, meta tags, or hidden elements to attempt to override the agent's behavior during reconnaissance phases.
Ingestion points: page.goto(url) and element discovery logic in references/patterns.md and SKILL.md.
Boundary markers: None identified in the provided scripts to distinguish between web content and agent instructions.
Capability inventory: Ability to execute shell commands (via with_server.py), write to the filesystem (screenshots), and perform network operations (Playwright navigation).
Sanitization: No sanitization of page content is performed before element inspection or screenshotting.
[CREDENTIALS_UNSAFE]: The documentation and examples (e.g., references/patterns.md and SKILL.md) encourage the use of environment variables like TEST_PASSWORD and ADMIN_PASSWORD. While these are standard practices for testing, they indicate the agent will handle sensitive authentication credentials at runtime.

e2e-testing