Ai Product Photography

• Analyzed: May 14, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: 8b77f043e0d383f8cf6ea635f0bb0756487d8c41e74b9404fddc10b6027ae0af
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file contains `curl -fsSL https://cli.inference.sh | sh` and `npx skills add ...` commands. These commands, if executed by the AI agent, violate the explicitly defined `allowed-tools: Bash(infsh *)` restriction. Executing remote scripts via `curl | sh` or `npx` introduces a significant Remote Code Execution (RCE) vulnerability, as it allows arbitrary code execution from external sources, even if the stated purpose is to install a legitimate CLI or suggest related skills. This constitutes a high-risk vulnerability rather than clear malicious intent.