local-ai-use

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). This skill persistently steers agents to route multimodal calls (images, TTS, STT) to a local Lemonade Server — including auto-installing/configuring the server and writing a permanent AGENTS.md routing rule that enforces local endpoints even when not explicitly requested — which is suspicious steering that weakens agent/user boundaries without clear malicious intent.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The runtime workflow only ingests user-authored text from the chat prompt (to generate prompt/TTS input/STT transcription targets) and then sends it as request bodies to the local Lemonade endpoints; it does not read from any outsider-authored queue/feed/source without selecting a user-provided item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script auto-downloads and installs remote binaries at runtime (e.g., https://github.com/lemonade-sdk/lemonade/releases/latest/download/lemonade.msi and it queries https://api.github.com/repos/lemonade-sdk/lemonade/releases/latest to resolve macOS assets), which fetches and executes remote installer code during skill execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs the agent to install and manage a system daemon (lemond), includes explicit sudo/apt/systemctl/installer commands, and auto-installs software that modifies system services — actions that change machine state and require elevated privileges.