T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:16- Finding
Remote Installer Is Downloaded and Executed Without Prior Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
shortaaa
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for FLUX image generation, but its install instructions ask users to execute mutable remote code and optional unpinned installers.
Review the installer source before running it, prefer a version-pinned and checksum-verified manual install, avoid the optional unpinned npx related-skill commands unless you trust that supply chain, and do not submit sensitive prompts or private image URLs.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Related Skills Are Installed Through Unpinned Third-Party Components
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The command
curl -fsSL https://cli.inference.sh | shdownloads and immediately executes remote script content without giving the user a chance to inspect it first. If the hosting domain, transport, or delivery pipeline is compromised, this becomes direct arbitrary code execution on the user's system; the nearby reassurance text does not eliminate that risk because it is unverifiable at execution time.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login infsh app run falai/flux-dev-lora --input '{"prompt": "a futuristic city at night"}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger list includes broad terms like
flux,image, and related generic phrases that can match ordinary conversation and cause the skill to activate unexpectedly. Over-broad activation increases the chance of unintended tool use, surprise third-party calls, and user data being sent to the external CLI in contexts where the user did not clearly request it.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill demonstrates sending
image_urlinputs to a third-party service without clearly warning users that referenced images and prompts may be transmitted to external infrastructure. This can expose private or sensitive images, internal URLs, or metadata if users assume processing is local or do not realize the privacy implications.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill recommends running
npx skills add ...without pinning a specific package version or commit. Becausenpxresolves and executes remote package code at install time, a future compromised or malicious package release could execute arbitrary code on the user's machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
This invocation again uses
npx skills add ...without version pinning, which causes execution of whatever package version is current at runtime. If the upstream package, dependency chain, or registry account is compromised, users may run attacker-controlled code simply by following the skill instructions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
An unpinned
npxcommand introduces software supply-chain risk because the referenced package can change over time and is executed immediately. In a skill file, this is especially risky because users may copy-paste commands without reviewing what code will be installed and run.- Content