Ai Voice Cloning

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: 0c78a43e062b5b899d575b56aab3233986fd121f94c8366da7c47de128dc14d3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the `curl -fsSL https://cli.inference.sh | sh` command present in the `SKILL.md` file. While this instruction is intended for installing the `inference.sh` CLI, the practice of piping a remote script directly to `sh` introduces a significant supply chain vulnerability and remote code execution risk if the `cli.inference.sh` domain or its hosted script were ever compromised. Although the `allowed-tools: Bash(infsh *)` constraint limits the agent's *runtime* execution to commands starting with `infsh`, the presence of this risky installation instruction in the markdown, which an AI agent might be prompted to execute during setup, constitutes a high-risk capability.