ClawHub
Back to skill

Security audit

LM Studio

Security checks for vulnerabilities and agentic risk

Overview

This LM Studio skill is mostly local and purpose-aligned, but needs review because it can persist home-directory notes about future activation while discouraging user-facing disclosure of those memory mechanics.

Review this before installing if you do not want a skill to keep persistent local notes. If installed, only allow it to create or update ~/lm-studio/ after you agree to what will be stored, keep MCP and remote endpoints explicit-only, and avoid saving credentials or sensitive prompt contents in the memory files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
## Common Traps

- Assuming port `1234` without checking reachability -> integrations fail even though the app looks healthy.
- Treating `GET /v1/models` as proof a model is ready -> Just-In-Time listings can appear before a usable runtime is confirmed.
- Reusing cloud model names in local requests -> the client is fine, but the local model identifier is wrong.
- Forcing JSON, tools, or vision on an unverified local model -> failures get blamed on prompts instead of capability mismatch.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-recipes.md (reported line 42)May include surrounding context.

3. Chat Completions Smoke Test

bash
curl -fsS http://localhost:1234/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "REPLACE_WITH_LOCAL_MODEL_ID",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · server-workflows.md (reported line 53)May include surrounding context.

3. Chat Completions Smoke Test

bash
curl -fsS http://localhost:1234/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "REPLACE_WITH_LOCAL_MODEL_ID",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-recipes.md (reported line 61)May include surrounding context.

LM Studio also supports the OpenAI-compatible responses endpoint, which matters for tools that expect it.

bash
curl -fsS http://localhost:1234/v1/responses \
  -H "Content-Type: application/json" \
  -d '{
    "model": "REPLACE_WITH_LOCAL_MODEL_ID",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api-recipes.md (reported line 74)May include surrounding context.

5. Embeddings Smoke Test

bash
curl -fsS http://localhost:1234/v1/embeddings \
  -H "Content-Type: application/json" \
  -d '{
    "model": "REPLACE_WITH_LOCAL_EMBEDDING_MODEL_ID",

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · mcp-playbooks.md (reported line 40)May include surrounding context.

md
## 4. Security Boundary

Some MCP servers can:
- Run arbitrary code.
- Access local files.
- Use the network.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · model-lifecycle.md (reported line 39)May include surrounding context.

text

Use cases:
- `--gpu=max` when the machine should use as much GPU offload as possible.
- `--gpu=auto` when you want the runtime to choose.
- `--context-length` when long contexts are pushing the machine too hard.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup text authorizes broad proactive activation for loosely defined topics like local models, localhost OpenAI-compatible endpoints, embeddings, or MCP work, and even when outputs are merely slow or low quality. That ambiguity can cause the skill to trigger outside the user's clear intent, increasing the chance of unsolicited behavior, incorrect tool use, or persistence/actions being applied in unrelated conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs itself to persist internal notes in a user-home file without any requirement to disclose that storage or obtain consent. In a security context, silent persistence of operational preferences, failure patterns, and trust-boundary information creates a privacy and integrity risk because data can accumulate across sessions in a location the user may not expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.