lpm-config
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to install the lpm tool using a piped shell script pattern.
- Evidence:
curl -fsSL https://raw.githubusercontent.com/gug007/lpm/main/install.sh | bashfound inREADME.mdandSKILL.md. - The resource originates from the skill author's repository and is required for the tool's functionality.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage project configurations and verify the environment.
- Evidence: Commands such as
command -v lpm,ls ~/.lpm/projects/*.yml,mkdir -p ~/.lpm/projects, andrm ~/.lpm/projects/<name>.ymlare used for project lifecycle management. - Evidence: A shell loop using
awkandsedis used to extract project root paths from configuration files. - [EXTERNAL_DOWNLOADS]: The skill fetches an installation script from an external source.
- Evidence:
https://raw.githubusercontent.com/gug007/lpm/main/install.sh. - [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration data which could theoretically contain malicious instructions.
- Ingestion points: The skill reads existing configuration files at
~/.lpm/projects/*.ymland accepts user input to modify them. - Boundary markers: The skill does not define specific delimiters for separating processed file content from instructions.
- Capability inventory: The skill can execute shell commands (
curl,ls,rm,awk,sed) and perform file system writes. - Sanitization: The
SKILL.mdfile includes a 'Validation' section requiring the agent to verify fields such as port ranges, path existence, and naming conventions before writing configurations.
Audit Metadata