Webapp Testing Anthropic

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a local web app testing helper, but its server helper can run unbounded shell commands and should be reviewed before installation.

Install only if you are comfortable with the agent running local dev-server commands from trusted project context. Review commands passed to --server, avoid using it on pages containing secrets unless needed, and treat saved screenshots or logs as potentially sensitive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose emphasizes Playwright-based webapp testing, but the skill also directs the agent to run arbitrary server commands and a follow-up command through a helper script. That mismatch can conceal materially more dangerous behavior than the description suggests, enabling unexpected process creation and command execution on the host.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: The finding is valid because raw server command strings are passed directly into a shell, enabling chaining, substitution, redirection, and other shell features. In an agent skill context, this increases abuse potential because a malicious task, repository artifact, or prompt could cause the tool to run unintended OS commands while appearing to merely start a local dev server.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: The finding is valid because raw server command strings are passed directly into a shell, enabling chaining, substitution, redirection, and other shell features. In an agent skill context, this increases abuse potential because a malicious task, repository artifact, or prompt could cause the tool to run unintended OS commands while appearing to merely start a local dev server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs use of shell commands and implies file/script creation, but it does not declare any tool restrictions or allowed tools. That increases the chance an agent will execute broader-than-necessary local commands, making the skill harder to sandbox and review safely.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Starting server {i+1}/{len(servers)}: {server['cmd']}")

            # Use shell=True to support commands with cd and &&
            process = subprocess.Popen(
                server['cmd'],
                shell=True,
                stdout=subprocess.PIPE,

• Confidence: 97% confidence
• Finding: The script launches server commands with subprocess.Popen(..., shell=True), causing each --server value to be interpreted by a shell. If any part of the server command is attacker-controlled or derived from untrusted input, shell metacharacters can inject arbitrary commands, leading to code execution under the user's account.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Run the command
        print(f"Running: {' '.join(args.command)}\n")
        result = subprocess.run(args.command)
        sys.exit(result.returncode)

    finally:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill encourages screenshots, DOM capture, and page-content inspection of local applications without warning that these artifacts may contain secrets, tokens, PII, or proprietary internal data. In a local webapp-testing context, this raises the likelihood of accidental sensitive data exposure through saved files or logs.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script writes a full-page screenshot to /tmp/page_discovery.png, which is a file write that can capture page contents, but there is no prior confirmation prompt or explicit warning beyond the inline code comment. The comment describes the action for developers, yet the script itself provides no user disclosure before saving potentially sensitive visual data.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This code fills form fields and clicks a submit button, which can alter application state or trigger side effects, but there is no user-facing warning beyond generic comments and a completion message. For code files, safety-relevant actions should have some disclosure such as a clearer comment, prompt, or documented warning unless the action is clearly framed as the skill's purpose.

Static analysis

No suspicious patterns detected.