lm-studio

Pass

Audited by Gen Agent Trust Hub on Mar 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the lms command-line interface for tasks such as starting servers, loading models, and running chat sessions. These commands are executed locally.
  • [EXTERNAL_DOWNLOADS]: The documentation directs users to download the necessary software from the official lmstudio.ai domain, which is a well-known service for local LLM inference.
  • [DATA_EXFILTRATION]: Demonstrates the use of curl to communicate with the local API on localhost:1234. No evidence of sensitive data being sent to external or unauthorized domains was found.
  • [PROMPT_INJECTION]: The skill demonstrates passing raw file content directly into model prompts (e.g., via cat archivo.txt). While this creates a surface for indirect prompt injection if the file content is untrusted, it is presented as a standard usage example for the tool's primary function.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 30, 2026, 12:18 AM