Ai Social Media Content

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the CLI requires trusting inference.sh’s remote installer and downloaded binary.

Why it was flagged

The skill instructs a remote installer to be piped into a shell. This is a disclosed, user-directed setup step for the stated CLI, but the installer code is not included in the provided artifact.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Install only if you trust inference.sh, and use the linked manual checksum verification before running the CLI.

What this means

The skill may use the user’s inference.sh account/session and any connected provider access when commands are run.

Why it was flagged

The skill requires logging into the inference.sh CLI. That is expected for this provider workflow, but the registry metadata does not declare a primary credential.

Skill content
infsh login
Recommendation

Log in only with the intended account, review connected app permissions, and revoke access if you stop using the skill.

What this means

If executed with a connected social account, the command could publish text and media publicly.

Why it was flagged

The skill includes a clearly labeled example that can publish content to Twitter/X through the infsh CLI. It is shown as an example rather than hidden automation, but posting public content is a high-impact action.

Skill content
# Post with Twitter automation
infsh app run twitter/post-tweet --input '{
  "text": "The future of AI is here. Here are the top 5 trends reshaping tech in 2024 🧵",
  "media_url": "<image-url>"
}'
Recommendation

Require explicit user confirmation before any post, preview the final text/media, and avoid connecting accounts that should not be used by the agent.

What this means

Prompts, image URLs, audio URLs, and generated content requests may leave the local environment.

Why it was flagged

The workflow uses an external CLI and provider apps such as Google Veo, OpenRouter/Claude, Flux, and avatar/voice tools, so user prompts and media URLs may be sent to third-party services.

Skill content
Create social media content for all platforms via [inference.sh](https://inference.sh) CLI.
Recommendation

Do not include confidential drafts, private faces/voices, or sensitive brand material unless you are comfortable sending them to the listed services.