webapp-testing
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/with_server.pyutilizessubprocess.Popenwithshell=Trueto run commands provided via the--serverCLI argument. This allows for arbitrary shell command execution, including command chaining and the use of shell metacharacters, which poses a risk if the agent handles untrusted server start-up strings. - [PROMPT_INJECTION]: The
SKILL.mdfile contains an explicit instruction to the agent: 'DO NOT read the source until you try running the script first'. This represents a concealment pattern that discourages the AI from performing a security audit on its tools before execution, potentially hiding risky implementation details like theshell=Truebehavior. - [PROMPT_INJECTION]: The skill creates an Indirect Prompt Injection surface by ingesting untrusted content from web pages (DOM, titles, console logs) through
scripts/playwright_runner.py. If a processed page contains malicious instructions, the agent might follow them, utilizing the command execution capabilities found inscripts/with_server.py.
Audit Metadata