Ai Music Generation

• Analyzed: May 15, 2026, 3:33 AM
• Findings: 1
• Version: 0.1.5
• Hash: f4919b86e91c43de77fddf0d6d44af61ffc4de18e7489c6182c5e70e202a98be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md instructs the AI agent to execute `curl -fsSL https://cli.inference.sh | sh` for CLI installation and `npx skills add` for installing related skills. Both `curl | sh` and `npx` commands involve downloading and executing arbitrary code from remote servers, which introduces significant supply chain risks and potential for remote code execution if the remote endpoints (inference.sh, npm registry) are compromised. While the stated purpose of the skill is benign (AI music generation), these instructions represent high-risk capabilities that could be exploited, classifying the skill as suspicious rather than benign or malicious.