webapp-testing
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/with_server.pyusessubprocess.Popenwithshell=Trueto start local web servers based on user-provided arguments. - Evidence: In
scripts/with_server.py, thesubprocess.Popen(server['cmd'], shell=True, ...)call executes the string provided to the--serverflag directly in a shell. - [COMMAND_EXECUTION]: The script
scripts/with_server.pyalso executes an arbitrary command provided by the user after the servers are ready. - Evidence: In
scripts/with_server.py, thesubprocess.run(args.command)call executes the trailing command-line arguments.
Audit Metadata