lemmaly

Warn

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill documentation includes a section on running an optional CLI scanner which involves downloading a repository and executing a JavaScript file at runtime.
  • Evidence: The 'Rule catalog' section provides instructions to git clone https://github.com/morsechimwai/lemmaly.git and then execute node "$tmpdir/lemmaly/cli/lemmaly.js" scan <path>.
  • [COMMAND_EXECUTION]: The skill provides the agent with specific shell commands to manage a temporary directory, clone a repository, and run scripts, which grants the skill significant interaction with the host environment.
  • Evidence: Commands such as mktemp -d, git clone, git -C ... checkout, and node ... are documented for the agent to use if the user requests a scan.
  • [EXTERNAL_DOWNLOADS]: The skill depends on an external GitHub repository for its core rule catalog and scanning tool, which is not a verified vendor source.
  • Evidence: The skill references https://github.com/morsechimwai/lemmaly.git as the source for the lemmaly CLI scanner.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 7, 2026, 11:32 PM
Security Audit — agent-trust-hub — lemmaly