lm-studio
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
lmscommand-line interface for tasks such as starting servers, loading models, and running chat sessions. These commands are executed locally. - [EXTERNAL_DOWNLOADS]: The documentation directs users to download the necessary software from the official
lmstudio.aidomain, which is a well-known service for local LLM inference. - [DATA_EXFILTRATION]: Demonstrates the use of
curlto communicate with the local API onlocalhost:1234. No evidence of sensitive data being sent to external or unauthorized domains was found. - [PROMPT_INJECTION]: The skill demonstrates passing raw file content directly into model prompts (e.g., via
cat archivo.txt). While this creates a surface for indirect prompt injection if the file content is untrusted, it is presented as a standard usage example for the tool's primary function.
Audit Metadata