webapp-testing

Pass

Audited by Gen Agent Trust Hub on Apr 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The helper script scripts/with_server.py uses subprocess.Popen with shell=True to execute server startup commands and subprocess.run to execute the final automation command. This is a functional requirement to support shell features like command chaining (e.g., cd backend && python server.py) and environment setup during local development testing.
  • [PROMPT_INJECTION]: The SKILL.md instructions explicitly direct the agent not to read the source code of the helper scripts unless necessary, citing context window limitations. While this is a common optimization for LLM agents, it effectively asks the agent to treat the provided scripts as black boxes, reducing transparency of executed logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 23, 2026, 01:41 PM