lemmaly
Warn
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (
https://github.com/morsechimwai/lemmaly.git) to provide an optional CLI scanner tool. This involves downloading third-party content into the agent's environment. - [REMOTE_CODE_EXECUTION]: The skill provides a bash script template designed to download and execute code from a remote source via
git clonefollowed bynodeexecution of a downloaded script. While it includes warnings to review the code and pin to a specific tag/commit, it creates a direct pathway for running untrusted code. - [COMMAND_EXECUTION]: The implementation of the optional scanner tool requires the agent to execute multiple shell commands, including directory creation (
mktemp), repository cloning, and script execution. These operations increase the attack surface if the agent is directed to run them automatically.
Audit Metadata