webapp-testing
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/with_server.pyusessubprocess.Popenwithshell=Trueto execute server startup commands andsubprocess.runto execute the final automation command. This is a functional requirement to support shell features like command chaining (e.g.,cd backend && python server.py) and environment setup during local development testing. - [PROMPT_INJECTION]: The
SKILL.mdinstructions explicitly direct the agent not to read the source code of the helper scripts unless necessary, citing context window limitations. While this is a common optimization for LLM agents, it effectively asks the agent to treat the provided scripts as black boxes, reducing transparency of executed logic.
Audit Metadata