selenium-skill

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for installing standard automation dependencies using official package managers, including npm (selenium-webdriver, mocha, chai), pip (selenium, pytest), Maven (selenium-java), and others for PHP, Ruby, and C#. These are necessary for the stated purpose of browser automation.
  • [COMMAND_EXECUTION]: Includes a local utility script scripts/scaffold-project.sh that automates the creation of a Maven-based project structure. The script performs legitimate operations such as directory creation and file generation via heredocs.
  • [INDIRECT_PROMPT_INJECTION]: As a code generation skill that processes user-described test scenarios, the skill has an inherent surface for indirect injection. However, it implements no automated execution of generated code, and the capability to perform network or file operations is confined to the Selenium WebDriver context controlled by the user.
  • [SAFE]: The automated scanner alert regarding the LambdaTest hub URL is determined to be a false positive. The URL hub.lambdatest.com is the official service endpoint for the skill's author, and its use is standard for Selenium RemoteWebDriver implementations.
Recommendations
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 16, 2026, 05:24 AM