local-ai-use
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
setup_local_ai.pyscript downloads installer packages from thelemonade-sdkrepository on GitHub. - It retrieves
.msifiles for Windows and.pkgfiles for macOS using theurllib.requestlibrary. - It queries the GitHub API to resolve the latest versioned download links for the target operating system.
- [REMOTE_CODE_EXECUTION]: The skill executes the downloaded binary installers to set up the local server daemon.
- On Windows, it runs
msiexecto perform a silent installation of the.msipackage. - On macOS, it utilizes the system
installerutility to process the downloaded.pkgfile. - [COMMAND_EXECUTION]: The setup script executes shell commands to configure the environment and manage system services.
- It uses
sudoon Linux and macOS to perform system-level installations and service management tasks. - It uses
subprocess.runwithshell=Trueon Linux to execute a command pipeline that adds a PPA and installs the server viaapt-get. - [PROMPT_INJECTION]: The skill modifies the workspace's
AGENTS.mdfile to persist local routing instructions for the agent, which represents an indirect prompt injection surface. - Ingestion points: The script writes directly to
AGENTS.mdin the workspace root, which is automatically read by many agent platforms. - Boundary markers: The injected instructions are wrapped in stable
<!-- BEGIN/END -->HTML comments to ensure updates are idempotent and correctly delimited. - Capability inventory: The skill has the capability to download files, execute system commands, and modify local configuration files.
- Sanitization: It utilizes static templates for instructions, interpolating only validated configuration values such as port numbers and predefined model IDs rather than raw user input.
Audit Metadata