Book Cover Design

• Analyzed: May 12, 2026, 3:41 AM
• Findings: 1
• Version: 0.1.5
• Hash: 3d1cfed9929cd841b376b82c19c01b5b23dad294edee18c7b9daa433d59a92df
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the `curl -fsSL https://cli.inference.sh | sh` command in `SKILL.md`. While the skill's stated purpose is benign (book cover design) and the instructions do not explicitly demonstrate malicious intent, this installation method is a significant security anti-pattern. It introduces a high-risk remote code execution (RCE) vulnerability, as it executes arbitrary code downloaded from an external server (`inference.sh`) without prior inspection, making the system vulnerable if `inference.sh` is compromised or malicious. The `allowed-tools: Bash(infsh *)` permission further enables this risky execution. There are no other clear indicators of malicious activity like data exfiltration or persistence.