Ai Avatar Video

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: 37cdd22de7710af21d201f692283f3567d4e3950479e423b8a0eff161760c4f4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the high-risk installation method specified in `SKILL.md`. The `curl -fsSL https://cli.inference.sh | sh` command directly downloads and executes a shell script from a remote server. While the `allowed-tools` specifies `Bash(infsh *)`, an AI agent could be prompted to execute this initial setup command, leading to a critical Remote Code Execution (RCE) vulnerability and supply chain risk if `cli.inference.sh` were compromised. There is no clear evidence of intentional malicious behavior by the skill author, but the method itself introduces a significant security flaw.