Landing Page Design

• Outcome: Pass
• Latest audit: May 28, 2026, 10:02 AM
• Version:
  0.1.5

Overview

This is a coherent landing-page design skill, but users should verify the third-party CLI installer and understand that prompts may be sent to external AI/search services.

Before installing, prefer manual download and checksum verification for the inference.sh CLI when possible. Treat infsh prompts and search queries as data sent to third-party services, and avoid using confidential customer, company, or strategy details unless that fits your provider terms, account settings, and billing expectations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start instruction tells users to download and execute a remote shell script directly via a pipe to sh. Even with a later install note mentioning checksum verification, the primary command encourages blind execution of network-delivered code, which is dangerous if the hosting domain, transport path, or script supply chain is compromised.

VirusTotal

66/66 vendors flagged this skill as clean.