lmeterx-web-loadtest

• Analyzed: Apr 3, 2026, 9:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 77b46cff9390f86f2375f1e6d751b4f563b9e0d982e7a657a3ba8ff40e21c3e3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a web load testing tool that interacts with the LMeterX platform (https://lmeterx.openxlab.org.cn). It is classified as suspicious due to a critical security vulnerability in scripts/run.py, which disables SSL certificate verification (verify=False), making the agent susceptible to man-in-the-middle attacks. Furthermore, the SKILL.md instructions are overly aggressive, mandating that the agent automatically initiate a full load testing workflow—including task creation—whenever a user mentions a URL, which could lead to unintended or unauthorized load testing of third-party websites. The script also utilizes a hardcoded default authentication token ('lmeterx').