Is skill/lws safe?
Use with caution. skill/lws is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the lws skill by skill a trust score of 77/100 with 5 findings (1 critical, 1 high).
Is skill/lws safe to install?
LWS is a cryptocurrency wallet management tool that poses significant security risks due to its remote code execution installation method and high-value target nature. While no active malicious behavior was detected during monitoring, the curl | bash installation pattern and cryptocurrency context create substantial attack surface.
What security issues were found in skill/lws?
Category Scores
Findings (5)
CRITICAL Remote Code Execution via curl | bash -50 ▶
The skill instructs downloading and executing arbitrary code from a remote server using the dangerous 'curl -fsSL https://raw.githubusercontent.com/dawnlabsai/lws/main/lws/install.sh | bash' pattern. This could allow arbitrary code execution if the repository is compromised.
HIGH Cryptocurrency Wallet Management Risk -40 ▶
This tool manages cryptocurrency private keys and wallets, making it a high-value target for attackers. If compromised, it could lead to theft of cryptocurrency assets.
MEDIUM System Modification During Installation -10 ▶
The installation process modifies system configuration including PATH variables and may install Rust via rustup, changing the system state beyond just adding the skill.
LOW Potential Sensitive Data Storage -10 ▶
The tool creates wallet descriptors in ~/.lws/wallets/ which could contain sensitive cryptocurrency information that might be targeted for exfiltration.
LOW External Repository Dependency -20 ▶
The skill depends on an external GitHub repository which introduces supply chain risks if the repository is compromised or becomes unavailable.
Should I install skill/lws?
Oathe's verdict for skill/lws is CAUTION with a trust score of 77/100. Recommendation: Install with caution.