webapp-testing

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/with_server.py uses subprocess.Popen with shell=True to execute server startup commands. This is a functional requirement to support common shell operations like directory navigation (cd) and command chaining (&&) typically used in web development start scripts.
  • [COMMAND_EXECUTION]: The scripts/with_server.py utility executes arbitrary shell commands passed as trailing arguments using subprocess.run, allowing the agent to run automation scripts after the server is ready.
  • [PROMPT_INJECTION]: The instructions in SKILL.md advise the agent to treat utility scripts as 'black boxes' and avoid reading their source code unless necessary to preserve context window space. While this is a common practice for context management in LLM agents, it encourages reliance on script behavior without direct inspection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 07:11 PM
Security Audit — agent-trust-hub — webapp-testing