ClawHub
Back to skill

Security audit

aenerate

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a FLUX image-generation helper, but it recommends mutable remote install commands that can execute local code and optional broad skill installs beyond the stated purpose.

Review before installing. Prefer a manually downloaded, version-pinned, checksum-verified inference.sh CLI install instead of piping a remote script to sh, avoid running install commands with elevated privileges, and do not install the optional broad related skills unless you separately trust and need them. Treat prompts and image URLs as data sent to inference.sh, so avoid secrets, private images, or internal-only URLs unless that is approved.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Remote Installer Executed Through a curl-to-shell Pipeline

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The Quick Start instructions download a mutable script from https://cli.inference.sh and pipe it directly to sh. The script is executed before the user can inspect it, pin its version, or independently verify its integrity.

The documentation states that the installer verifies the SHA-256 checksum of the binary it subsequently downloads. This does not establish the integrity of the bootstrap script itself because that script remains remotely controlled and can change after the Skill has been reviewed. HTTPS provides transport protection but does not mitigate compromise of the hosting infrastructure, publishing account, DNS/TLS trust path, or installer generation process.

Installing a CLI is relevant to the declared functionality, but executing mutable remote shell code is not the minimum privilege or safest installation method necessary to provide FLUX image generation.

Attack Path

  1. An attacker compromises the remote installer host, its deployment pipeline, publishing credentials, or another part of the trusted delivery path.
  2. The attacker modifies the script returned by https://cli.inference.sh.
  3. A user follows the documented Quick Start command.
  4. curl retrieves the attacker-controlled content and passes it directly to sh.
  5. The payload executes with all permissions of the user running the command.
  6. The payload may access user-readable files, alter shell configuration, install additional programs, or intercept the subsequent infsh login process.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. The accessible scope may include project files, ...[truncated 314 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the pipe-to-shell installation command from the Quick Start instructions.
  2. Direct users to download a version-pinned binary from an immutable release URL.
  3. Publish a trusted SHA-256 digest or, preferably, a cryptographic signature for each release.
  4. Require users to verify the downloaded artifact before executing or installing it.
  5. Pin the installer and CLI to an explicit version rather than using a mutable endpoint.
  6. Document a nonprivileged installation directory and explicitly advise users not to run installation commands as root.
  7. If an installation script remains available, instruct users to download it as a file, inspect it, verify its signature or pinned digest, and only then execute it.
  8. Keep authentication separate from installation so a compromised installer cannot seamlessly lead users into entering credentials.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:72
Finding

Unpinned Third-Party Skill Installation Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72–78
Vulnerability Type: Mutable and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@inference-sh

# All image generation models
npx skills add inference-sh/skills@ai-image-generation

# Upscaling
npx skills add inference-sh/skills@image-upscaling

Technical Analysis

These commands invoke npx without pinning the executed skills package to an exact version or integrity value. They also identify remotely resolved Skill components without an immutable revision. Consequently, the effective package and Skill contents can change independently after this project has been audited.

The first command installs a broad platform Skill covering more than 150 applications. That scope exceeds the minimum functionality declared by this Skill, which is focused on FLUX image generation. Installing additional, unaudited Skills expands the dependency and capability surface without being necessary for the primary feature.

No evidence in the reviewed project proves that these upstream dependencies are currently malicious. The vulnerability is the unsafe, mutable supply-chain installation pattern and the absence of version and integrity controls.

Attack Path

  1. An attacker compromises the package or upstream Skill repository, its maintainer credentials, release process, or dependency chain.
  2. The attacker publishes modified content under a version or reference selected by the unpinned command.
  3. A user follows one of the Related Skills installation examples.
  4. npx resolves and executes remote package code, which then retrieves or installs the referenced Skill.
  5. The compromised package or Skill executes installation behavior or introduces malicious instructions and capabilities into the user's Agent environment.
  6. In the broa ...[truncated 692 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the optional Related Skills installation commands unless they are necessary for the declared FLUX functionality.
  2. Pin the skills package to an exact reviewed version rather than allowing npx to resolve the current release.
  3. Pin each referenced Skill to an immutable commit, release identifier, or content digest.
  4. Use package-manager integrity verification and a trusted lockfile where supported.
  5. Review package lifecycle scripts and upstream Skill contents before recommending installation.
  6. Prefer the smallest FLUX-specific dependency instead of the full platform package containing more than 150 applications.
  7. Run installation in a restricted environment without administrative privileges or unnecessary credentials.
  8. Establish an update process in which new versions are audited before documentation is changed to reference them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The command curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a classic arbitrary code execution pattern. Even with a note claiming checksum verification, users are still trusting a network-fetched installer at execution time; compromise of the hosting domain, TLS endpoint, or install script supply chain could result in full code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

infsh app run falai/flux-dev-lora --input '{"prompt": "a futuristic city at night"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad terms such as flux, image, ai, and model-related phrases that can overlap with ordinary user requests. Overbroad triggers can cause the skill to activate unexpectedly, increasing the chance that users are steered into running external CLI commands or sending data to a remote service when they did not explicitly intend to use this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill shows commands that send prompts and image URLs to inference.sh but does not clearly warn users that their input data leaves the local environment and is processed by a third-party service. This can lead to inadvertent disclosure of sensitive prompts, images, or internal URLs, especially in enterprise or privacy-sensitive contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill recommends running npx skills add ... without pinning a specific package version or commit, which causes execution of whatever package version is current at install time. If the upstream package or dependency chain is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This npx skills add ... command is unpinned, so the exact code fetched and executed can change over time without review. That creates a supply-chain risk where a malicious or hijacked release could execute arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Referencing npx skills without version pinning introduces non-deterministic code execution from the npm ecosystem. In a skill file, this is especially risky because users may copy-paste commands directly and implicitly trust them.

Content

No source excerpt is available for this finding.