using-lwc
Warn
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/install-lwc.shscript downloads platform-specific binaries from the author's GitHub repository (https://github.com/JanYork/llm-wiki-cli/). The script uses hardcoded SHA-256 checksums to verify the integrity of the downloaded files. - [REMOTE_CODE_EXECUTION]: The skill executes the downloaded binary after granting it execution permissions. This binary serves as the core logic for the agent's memory system.
- [COMMAND_EXECUTION]: Shell scripts (
bootstrap.shandinstall-lwc.sh) are used to manage the installation and initialization of the tool, performing environment checks and file system operations. - [PERSISTENCE]: The
lwc agent installcommand is designed to modify the agent's configuration files to register MCP servers, hooks, and instructions, ensuring the memory system persists across sessions. - [INDIRECT_PROMPT_INJECTION]: The tool ingests and processes external documentation into a wiki format. Malicious content in these documents could potentially influence agent behavior through the memory recall process.
- Ingestion points: External files are added via
lwc source add(identified inSKILL.mdandreferences/active-memory.md). - Boundary markers:
references/active-memory.mdinstructs the agent to treat embedded instructions as untrusted. - Capability inventory: The CLI tool writes to a local SQLite database and generates Markdown files.
- Sanitization: The instructions require the agent to analyze content and generate synthetic pages (summaries/concepts) rather than performing direct ingestion.
Audit Metadata