webapp-testing
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/with_server.pyusessubprocess.Popenwithshell=Trueto execute server startup commands. This is a functional requirement to support common shell operations like directory navigation (cd) and command chaining (&&) typically used in web development start scripts. - [COMMAND_EXECUTION]: The
scripts/with_server.pyutility executes arbitrary shell commands passed as trailing arguments usingsubprocess.run, allowing the agent to run automation scripts after the server is ready. - [PROMPT_INJECTION]: The instructions in
SKILL.mdadvise the agent to treat utility scripts as 'black boxes' and avoid reading their source code unless necessary to preserve context window space. While this is a common practice for context management in LLM agents, it encourages reliance on script behavior without direct inspection.
Audit Metadata