webapp-testing
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/with_server.pyusessubprocess.Popenwithshell=Trueto execute commands provided via the--serverargument. This is designed to start local development servers (e.g.,npm run dev), but it allows for arbitrary shell command execution if the input is not carefully controlled by the agent. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external or local web applications (DOM content, console logs, and screenshots). This untrusted data can contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Browser DOM content, console logs, and page screenshots processed in
examples/element_discovery.pyandexamples/console_logging.py. - Boundary markers: No specific boundary markers or instructions to ignore embedded content are provided when the agent inspects the rendered DOM.
- Capability inventory: The skill can execute shell commands (
scripts/with_server.py), write files to the output directory (/mnt/user-data/outputs/), and perform network requests or local file access via Playwright. - Sanitization: There is no evidence of sanitization or filtering applied to the web content before it is processed by the agent.
Audit Metadata