lazycat-lpk-builder

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a technical manual for the Lazycat MicroServer ecosystem. It describes standard development workflows including build commands, manifest configuration, and application publishing.
  • [COMMAND_EXECUTION]: Provides instructions for using the lzc-cli tool to build (project build) and install (app install) applications. This is expected functionality for a developer assistant.
  • [EXTERNAL_DOWNLOADS]: Documents the process of importing external Docker images into the platform's registry using lzc-cli appstore copy-image. All references point to official platform domains.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it analyzes existing user code and Docker configurations to generate microserver manifests. Ingestion points: SKILL.md (via analysis of user-provided app source/config). Boundary markers: None specified in the instructions. Capability inventory: Shell command execution via lzc-cli for building/deploying. Sanitization: Output is guided by structured schema specifications in references/.
  • [PRIVILEGE_ESCALATION]: The guide mentions high-privilege configurations such as root user access within containers and privileged mode for specific use cases like VPNs or hardware access. These are documented as platform features with corresponding security considerations in the store publishing guidelines.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 07:13 AM