lemmaly
Warn
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation includes a section on running an optional CLI scanner which involves downloading a repository and executing a JavaScript file at runtime.
- Evidence: The 'Rule catalog' section provides instructions to
git clone https://github.com/morsechimwai/lemmaly.gitand then executenode "$tmpdir/lemmaly/cli/lemmaly.js" scan <path>. - [COMMAND_EXECUTION]: The skill provides the agent with specific shell commands to manage a temporary directory, clone a repository, and run scripts, which grants the skill significant interaction with the host environment.
- Evidence: Commands such as
mktemp -d,git clone,git -C ... checkout, andnode ...are documented for the agent to use if the user requests a scan. - [EXTERNAL_DOWNLOADS]: The skill depends on an external GitHub repository for its core rule catalog and scanning tool, which is not a verified vendor source.
- Evidence: The skill references
https://github.com/morsechimwai/lemmaly.gitas the source for thelemmalyCLI scanner.
Audit Metadata