smartui-skill

Fail

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official CLI tool @lambdatest/smartui-cli and the Playwright framework browsers from standard package registries.
  • [COMMAND_EXECUTION]: The instructions include shell commands for setting up project configurations (npx smartui config:create) and executing test suites (npx smartui exec) which is necessary for the skill's primary functionality of visual testing.
  • [DYNAMIC_EXECUTION]: The skill utilizes page.evaluate() in Playwright and executeScript() in Selenium to interact with the browser context and trigger the visual capture engine on the LambdaTest platform. This is a standard integration method for these testing libraries.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes external web content via page.goto() and automated URL crawling.
  • Ingestion points: External URLs defined in urls.json and web content accessed during test execution.
  • Boundary markers: The skill uses stability markers like waitForLoadState('networkidle') and waitForTimeout before taking actions.
  • Capability inventory: The skill has the capability to execute shell commands via npx, write to the local filesystem (reports and baseline screenshots), and perform network operations to communicate with the LambdaTest cloud hub.
  • Sanitization: There is no explicit sanitization of the remote web content before processing, which is typical for visual testing tools.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 23, 2026, 02:05 PM