using-lwc

Warn

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/install-lwc.sh script downloads platform-specific binaries from the author's GitHub repository (https://github.com/JanYork/llm-wiki-cli/). The script uses hardcoded SHA-256 checksums to verify the integrity of the downloaded files.
  • [REMOTE_CODE_EXECUTION]: The skill executes the downloaded binary after granting it execution permissions. This binary serves as the core logic for the agent's memory system.
  • [COMMAND_EXECUTION]: Shell scripts (bootstrap.sh and install-lwc.sh) are used to manage the installation and initialization of the tool, performing environment checks and file system operations.
  • [PERSISTENCE]: The lwc agent install command is designed to modify the agent's configuration files to register MCP servers, hooks, and instructions, ensuring the memory system persists across sessions.
  • [INDIRECT_PROMPT_INJECTION]: The tool ingests and processes external documentation into a wiki format. Malicious content in these documents could potentially influence agent behavior through the memory recall process.
  • Ingestion points: External files are added via lwc source add (identified in SKILL.md and references/active-memory.md).
  • Boundary markers: references/active-memory.md instructs the agent to treat embedded instructions as untrusted.
  • Capability inventory: The CLI tool writes to a local SQLite database and generates Markdown files.
  • Sanitization: The instructions require the agent to analyze content and generate synthetic pages (summaries/concepts) rather than performing direct ingestion.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 27, 2026, 07:45 AM