local-ai-use
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
setup_local_ai.pyscript fetches installers and metadata from official vendor sources on GitHub. - Fetches the
lemonade.msiinstaller from thelemonade-sdk/lemonaderepository. - Retrieves release metadata via the GitHub API for the same repository to identify versioned assets.
- Downloads macOS package installers directly from the project's official release page.
- [REMOTE_CODE_EXECUTION]: The skill automates the installation of the Lemonade Server by executing the downloaded binaries.
- Windows: Runs
msiexecto perform a silent installation of the MSI package. - macOS: Executes the
installerutility to process downloaded package files. - [COMMAND_EXECUTION]: The setup script utilizes standard system tools to manage the installation environment across different platforms.
- Invokes
wingeton Windows andbrewon macOS for package management. - Executes
apt-getvia a shell pipeline on Linux to add stable repositories and install server components. - [PRIVILEGE_ESCALATION]: Administrative access is requested during the installation process on Linux and macOS to manage system-level services.
- Uses
sudofor repository configuration and package installation on Linux distros. - Uses
sudoto run the system installer on macOS. - [PROMPT_INJECTION]: The skill instructions contain directives intended to persistently steer the agent's behavior regarding multimodal routing.
- Directs the agent to prioritize local inference endpoints over cloud providers, even if the user does not explicitly request local processing in a specific turn.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a persistent instruction set within the workspace to govern future agent interactions.
- Ingestion points: The script
scripts/setup_local_ai.pywrites a routing rule block to the workspaceAGENTS.mdfile. - Boundary markers: The injected instructions are enclosed in stable comment markers (
amd-skills:local-ai-use) to allow for idempotent updates. - Capability inventory: The skill has capabilities for shell command execution, network communication, and local file modification.
- Sanitization: Instruction content is derived from a local template (
templates/local-ai-rule.md) and populated with environment-specific parameters like local host and port.
Audit Metadata