Ai Product Photography

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the CLI runs code from an external source on the user's machine.

Why it was flagged

The skill recommends installing a remote CLI via a shell pipeline. This is disclosed and purpose-aligned, but the installer itself is not included in the artifact set.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Review the installer source, use the documented manual checksum verification, and install only if you trust inference.sh.

What this means

The agent may use the inference.sh CLI for image-generation tasks, which could consume account resources depending on the service configuration.

Why it was flagged

The skill allows the agent to run infsh CLI commands. The visible examples are aligned with image generation, but the CLI access is broader than a single fixed command.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Confirm generated commands before running expensive or bulk image jobs, especially when using a paid inference.sh account.

What this means

The skill may operate using the user's inference.sh account and any associated quotas, billing, or permissions.

Why it was flagged

The quick start requires logging into an external inference.sh account, even though the registry metadata lists no primary credential.

Skill content
infsh login
Recommendation

Use an account with appropriate limits and understand what permissions or billing apply before generating images.

What this means

Product descriptions, campaign concepts, or other prompt details may be transmitted to external services.

Why it was flagged

The skill sends image prompts through an external inference provider and lists third-party model backends such as FLUX, Imagen 3, Grok, and Seedream.

Skill content
Generate professional product photography via [inference.sh](https://inference.sh) CLI.
Recommendation

Avoid including confidential launch plans, unreleased product details, or sensitive branding information in prompts unless the provider's privacy terms are acceptable.