webapp-testing

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION

Full Analysis

[COMMAND_EXECUTION]: The utility script scripts/with_server.py uses subprocess.Popen with shell=True to run commands provided in the --server argument. This is intended to facilitate complex server startup commands but allows arbitrary command execution.
[INDIRECT_PROMPT_INJECTION]: Interacting with web content exposes the agent to indirect prompt injection risks, as malicious instructions could be embedded in the HTML or console output of the application being tested.

Audit Metadata

Risk Level

SAFE

Analyzed

Sep 15, 2026, 07:17 PM