firebase-test-lab-migration-skill
Fail
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official HyperExecute CLI and Tunnel binaries from the vendor's distribution server (downloads.lambdatest.com). These downloads are restricted to the vendor's official technology stack.
- [COMMAND_EXECUTION]: Provides instructions for using shell commands, such as curl, to communicate with TestMu AI APIs for uploading test artifacts and orchestrating builds. These actions are consistent with the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill uses a local script (scripts/detect.py) to scan the user's repository for vendor-specific strings. This involves processing untrusted local content to guide the migration process, though the script performs no outbound network operations and only read-only file access.
- [SAFE]: The endpoint 'https://hub.lambdatest.com/wd/hub', which appeared in automated scan alerts, is the standard and legitimate Selenium Grid hub for LambdaTest and is not a phishing risk in this context.
- [SAFE]: Credentials are managed via LT_USERNAME and LT_ACCESS_KEY environment variables rather than being hardcoded, aligning with standard security recommendations for secret management.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata