Flux Image

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: cb5f4d86dbeb1dfcd426a5edc807e3360f83b22c4b8a5d9c8425f1708ac4e4b8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file contains a prompt injection vulnerability. The 'Quick Start' section instructs the AI agent to execute `curl -fsSL https://cli.inference.sh | sh`. This command downloads and executes a remote shell script, which is a significant remote code execution (RCE) risk. This instruction falls outside the explicitly defined `allowed-tools: Bash(infsh *)`, indicating that the agent is being prompted to perform an action beyond its authorized scope. While the stated purpose is installation, the method introduces a severe vulnerability.