webapp-testing

Warn

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/with_server.py utilizes subprocess.Popen with shell=True to run commands provided via the --server CLI argument. This allows for arbitrary shell command execution, including command chaining and the use of shell metacharacters, which poses a risk if the agent handles untrusted server start-up strings.
  • [PROMPT_INJECTION]: The SKILL.md file contains an explicit instruction to the agent: 'DO NOT read the source until you try running the script first'. This represents a concealment pattern that discourages the AI from performing a security audit on its tools before execution, potentially hiding risky implementation details like the shell=True behavior.
  • [PROMPT_INJECTION]: The skill creates an Indirect Prompt Injection surface by ingesting untrusted content from web pages (DOM, titles, console logs) through scripts/playwright_runner.py. If a processed page contains malicious instructions, the agent might follow them, utilizing the command execution capabilities found in scripts/with_server.py.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 23, 2026, 09:24 PM
Security Audit — agent-trust-hub — webapp-testing