ClawHub
Back to skill

Security audit

Agent Tools

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent inference.sh CLI helper, but it repeatedly recommends unverified remote shell installation and unpinned external skill installs, so users should review it carefully before installing.

Install only if you trust the inference.sh installer endpoint and are comfortable with a remote script running as your user. Prefer the manual download-and-verify path, pin versions where possible, review related skills separately before adding them, and treat prompts, files, API keys, and Twitter/X actions as leaving your local environment when you run `infsh`.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-17
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
## Install CLI

curl -fsSL https://cli.inference.sh | sh
infsh login

Technical Analysis

The installation procedure downloads mutable content from https://cli.inference.sh and sends it directly to sh. The downloaded script is therefore executed before the user can inspect it or verify its integrity. Its effective behavior can change at any time after this Skill has been audited.

HTTPS protects transport under ordinary circumstances but does not protect users if the hosting account, web server, DNS configuration, certificate infrastructure, or release pipeline is compromised. The subsequent claim that the installer verifies the CLI binary does not address this trust gap: the unverified installer itself is already running and can bypass or falsify any later verification.

This behavior exceeds the minimum privileges necessary to install the CLI because the same document provides a manual download-and-verification procedure. Installation does not inherently require immediate interpretation of a mutable network response.

Attack Path

  1. An attacker compromises the installer endpoint, its hosting infrastructure, DNS, certificate chain, or deployment pipeline.
  2. The attacker replaces the installer response with a malicious shell script.
  3. A user or agent follows the documented installation command.
  4. curl retrieves the attacker-controlled response and pipes it directly into sh.
  5. The payload executes with all permissions available to the invoking account.
  6. The payload can read accessible credentials, modify user files, replace executables, or establish persistence without performing the advertised installation.

Impact Assessment

Successful exploitation grants arbitrary command execution with the privileges of the user ...[truncated 461 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the pipe-to-shell installation command.
  • Require an immutable, version-pinned release artifact rather than a moving “latest” installer.
  • Download the artifact to disk before execution or installation.
  • Verify its SHA-256 digest against a value obtained from an independently trusted, versioned source.
  • Prefer mandatory Sigstore verification rather than making signature verification conditional on whether cosign happens to be installed.
  • Display the resolved URL and version to the user and require explicit approval before installing.
  • Install only into a user-owned directory such as ~/.local/bin; do not request elevated privileges.
  • Avoid sha256sum --ignore-missing for security-critical verification. Explicitly identify the expected artifact and fail closed if its checksum entry is absent.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/authentication.md:3
Finding

Authentication Guide Repeats Unsafe Remote Shell Execution

Content
View full analysis

Vulnerability Details

File Location: references/authentication.md:3-7 and references/authentication.md:39-45
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
## Install the CLI

```bash
curl -fsSL https://cli.inference.sh | sh
text

The same unsafe operation is recommended again for updates:

```bash
## Update CLI

```bash
infsh update

Or reinstall:

bash
curl -fsSL https://cli.inference.sh | sh
text

### Technical Analysis

Both initial installation and reinstallation execute a mutable response from an external service without prior inspection, version pinning, checksum validation, or signature verification. Recommending the operation as an update mechanism makes the exposure recurring rather than limited to initial setup.

Because authentication is performed immediately after installation and the document also supports `INFSH_API_KEY`, a malicious installer could target credentials subsequently used by the CLI or already present in the environment. No credential theft is embedded in the audited files, but arbitrary shell execution gives a compromised installer the technical ability to access any credentials available to the invoking process.

### Attack Path

1. An attacker gains control over the installer response or its delivery chain.
2. A user follows either the installation or reinstallation guidance.
3. The malicious response is passed directly to `sh`.
4. The payload executes under the user's account.
5. It can inspect environment variables, user configuration, and authentication material accessible to that account.
6. During an update, it can replace an existing trusted CLI with a malicious implementation that captures later commands or credentials.

### Impact Assessment

The immediate impact is arbitrary code execution under the invoking user's privileges. Accessible API keys, local CLI credentia
...[truncated 390 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace both pipe-to-shell examples with a version-pinned manual installation process.
  • Download the installer or binary to a local file and verify it before any execution.
  • Publish checksums and signatures through a separately protected, immutable release channel.
  • Require signature verification and fail closed on an absent or invalid signature.
  • Use a package manager with signed, versioned packages where practical.
  • Make updates explicit and version-aware; do not silently reinstall from a mutable endpoint.
  • Document the exact location and permissions of locally stored credentials.
  • Recommend short-lived, narrowly scoped API keys and prevent secrets from being exposed in shell history or logs.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/cli-reference.md:3
Finding

CLI Reference Promotes Direct Execution of a Mutable Network Response

Content
View full analysis

Vulnerability Details

File Location: references/cli-reference.md:3-7
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
## Installation

```bash
curl -fsSL https://cli.inference.sh | sh
text

### Technical Analysis

The reference documentation instructs users to interpret data received from an external URL as shell code. There is no local review boundary, immutable version selection, or integrity verification before execution. Consequently, the code that actually runs is not the code reviewed in this project.

The operation is unnecessary for the Skill's minimum declared functionality. A downloaded, pinned, and verified CLI artifact can provide the same functionality without granting an unverified network response an immediate code-execution channel.

### Attack Path

1. The external installer or delivery infrastructure is compromised.
2. An attacker serves modified shell commands from the documented URL.
3. A user copies the command from the CLI reference.
4. The response is executed directly by `sh`.
5. The attacker's commands operate with the invoking user's permissions.

### Impact Assessment

Exploitation permits arbitrary local command execution as the invoking user. This may allow theft of environment secrets and readable files, modification of user-owned data, installation of malicious binaries, or persistence where the user has sufficient permissions. The audited command does not itself elevate privileges.
Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sh example.
  • Pin the CLI to a specific reviewed release.
  • Download the corresponding artifact without executing it.
  • Verify a cryptographic signature and expected digest before extraction.
  • Abort installation if the version, signature, checksum, platform, or expected filename does not match.
  • Install into a non-privileged user directory and clearly document all filesystem changes.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:82
Finding

Related Skills Are Installed from Unpinned Third-Party References

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:82-108
Vulnerability Type: Insecure dependency and Skill supply-chain usage
Risk Level: Medium

Vulnerable Code:

bash
## Related Skills

```bash
# Image generation (FLUX, Gemini, Grok, Seedream)
npx skills add inference-sh/skills@ai-image-generation

# Video generation (Veo, Seedance, Wan, OmniHuman)
npx skills add inference-sh/skills@ai-video-generation

# LLMs (Claude, Gemini, Kimi, GLM via OpenRouter)
npx skills add inference-sh/skills@llm-models

# Web search (Tavily, Exa)
npx skills add inference-sh/skills@web-search

# AI avatars & lipsync (OmniHuman, Fabric, PixVerse)
npx skills add inference-sh/skills@ai-avatar-video

# Twitter/X automation
npx skills add inference-sh/skills@twitter-automation

# Model-specific
npx skills add inference-sh/skills@flux-image
npx skills add inference-sh/skills@google-veo

# Utilities
npx skills add inference-sh/skills@image-upscaling
npx skills add inference-sh/skills@background-removal
text

### Technical Analysis

The commands invoke `npx` without pinning the `skills` runner itself to a reviewed immutable version. They also install related Skills using symbolic names rather than immutable commit hashes or verified release identifiers. Both the executable runner and installed Skill content can therefore change after this audit.

Skill packages are particularly sensitive dependencies because their instructions can influence agent behavior and tool use. No malicious content in these related Skills was available in the audited project, so compromise is not established. The confirmed weakness is that the documentation delegates installation to mutable, externally controlled supply-chain components without documented integrity verification.

### Attack Path

1. An attacker compromises the package used by `npx`, the referenced repository or publisher account, or an upstream release process
...[truncated 924 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the skills runner to an exact reviewed version rather than invoking an implicit latest version through npx.
  • Pin every related Skill to an immutable commit hash or cryptographically verified release.
  • Maintain lockfiles or a signed manifest recording the exact runner and Skill revisions.
  • Verify publisher identity, checksums, and signatures before installation.
  • Review each related Skill independently, including its allowed tools and external instructions.
  • Disable package lifecycle scripts where they are unnecessary and supported by the tooling.
  • Present related Skills as optional dependencies and require explicit user approval before installation.
  • Re-audit and deliberately update pins rather than automatically following mutable upstream references.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl ... | sh fetches a remote script and executes it immediately, which is dangerous because any compromise of the server, transport, DNS, or publishing pipeline becomes direct code execution on the user's machine. Although the surrounding text claims checksum and optional signature verification, those protections occur inside the fetched script, so they do not protect against a malicious or tampered installer itself.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install CLI

bash
curl -fsSL https://cli.inference.sh | sh
infsh login

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | sh chain turns a network response directly into shell execution, collapsing retrieval and execution into one step with no independent review boundary. In a skill file, this is especially risky because users may copy-paste it verbatim, making compromise of the remote content immediately exploitable.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install CLI

bash
curl -fsSL https://cli.inference.sh | sh
infsh login

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

This is a direct external script fetch and execution pattern: the content retrieved from the network is immediately executed by the shell without validation. That creates a supply-chain execution path where any compromise of the distribution endpoint or network trust can translate into instant code execution on the user's machine.

Content

Scanner excerpt · references/authentication.md (reported line 6)May include surrounding context.

Install the CLI

bash
curl -fsSL https://cli.inference.sh | sh

Login

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The shell pipe into sh is the dangerous chaining mechanism that turns a network retrieval into immediate execution. In practice, this eliminates the user's chance to review content and makes any upstream compromise materially more dangerous.

Content

Scanner excerpt · references/authentication.md (reported line 6)May include surrounding context.

Install the CLI

bash
curl -fsSL https://cli.inference.sh | sh

Login

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The reinstall instructions repeat the same unsafe external script execution pattern, creating another documented path for arbitrary code execution from a remote source. Repetition increases exposure because users may run it during troubleshooting, often with reduced scrutiny and elevated privileges.

Content

Scanner excerpt · references/authentication.md (reported line 44)May include surrounding context.

Or reinstall:

bash
curl -fsSL https://cli.inference.sh | sh

Troubleshooting

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This repeated | sh chaining pattern preserves the same arbitrary-execution risk in the reinstall flow. Because troubleshooting instructions are often copied verbatim, this can normalize unsafe behavior and broaden exploitation opportunities.

Content

Scanner excerpt · references/authentication.md (reported line 44)May include surrounding context.

Or reinstall:

bash
curl -fsSL https://cli.inference.sh | sh

Troubleshooting

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://cli.inference.sh | sh is a classic remote code execution pattern because it executes whatever content is returned by the remote server directly in the user's shell. In the context of an agent skill that encourages automation and CLI usage, this is especially dangerous because users may run it reflexively or non-interactively, magnifying the blast radius of any compromise.

Content

Scanner excerpt · references/cli-reference.md (reported line 6)May include surrounding context.

Installation

bash
curl -fsSL https://cli.inference.sh | sh

Global Commands

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh chaining causes unreviewed network content to flow directly into command execution, removing the user's opportunity to inspect what will run. This enables supply-chain compromise, server-side takeover, or content manipulation to become immediate code execution on the installing machine.

Content

Scanner excerpt · references/cli-reference.md (reported line 6)May include surrounding context.

Installation

bash
curl -fsSL https://cli.inference.sh | sh

Global Commands

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases like ai model, run ai, ai api, and model names that can match many unrelated user requests. Overbroad auto-activation increases the chance the skill is invoked in contexts where its powerful Bash-enabled and external-network behaviors are unnecessary or unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description advertises web search, LLM calls, image/video generation, and Twitter/X automation, all of which can transmit user data or affect external accounts, but it does not warn users about those consequences. In skill-selection context, missing disclosure can cause users to invoke the skill without understanding that prompts, files, or account actions may leave the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The skill recommends invoking npx skills add ... without pinning an exact package version or immutable source reference. That allows the fetched package content to change over time, so a future compromised or malicious release could execute unexpected code during installation in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This npx skills add ... example installs code from a moving target rather than a pinned version. If the upstream package, tag, or dependency chain is hijacked, users following the documentation could run attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Using unpinned npx installation commands introduces supply-chain risk because the resolved package can differ across time and environments. A compromised maintainer account or dependency could convert this documentation example into remote code execution on install.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The command relies on unpinned npx skills behavior, which means the fetched code is not reproducible or stable. That creates a realistic supply-chain exposure for anyone copying the example directly from the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

An unpinned npx skills add command can silently pull different code in the future. In a skill file, such copy-pasteable install steps are especially risky because users may run them with minimal scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This installation example does not constrain the version of the package being executed. That increases exposure to upstream compromise, typo/squat issues, or malicious updates that would execute during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

Because the npx invocation is unpinned, users are trusting the latest resolver output at execution time. That is a classic documentation-induced supply-chain risk with code-execution consequences if the package is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The example references npx skills without an exact version, making the installed code mutable over time. That weakens reproducibility and can expose users to malicious package changes or dependency compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

This command demonstrates executing an unpinned package via npx, which is a supply-chain hazard in security-sensitive documentation. Anyone following it could execute altered code if the package or publishing account is compromised later.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The use of unversioned npx skills add leaves users dependent on whatever code is current when they run the command. In practice, that can enable remote code execution through package takeover or malicious updates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation instructs users to pipe a remotely fetched script directly into the shell, which enables arbitrary code execution if the remote host, CDN, DNS, TLS trust chain, or publishing pipeline is compromised. Because this is an installation step for a CLI with authentication and API access, compromise could lead to credential theft or full workstation compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation command instructs users to fetch a remote script over the network and execute it immediately in a shell, without any integrity verification, pinning, or warning. If the hosting domain, transport path, or served script is compromised, users could execute arbitrary attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes a file-writing command (infsh app list --save apps.json) but does not mention that it will create or overwrite a local file. Under the markdown-specific warning criterion, user-facing documentation should disclose behaviors that affect user data or the local filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Storing an API key in an environment variable is common, but documenting it without any warning can still expose credentials through shell history, process listings in some environments, CI logs, debug output, or inherited subprocess environments. In a tool that automates many third-party AI services, leaked credentials could enable unauthorized API usage and account abuse.

Content

No source excerpt is available for this finding.