Agent Tools

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:52 PM UTC
• Version: 0.1.5

Overview

The skill is a coherent inference.sh CLI helper, but it repeatedly recommends unverified remote shell installation and unpinned external skill installs, so users should review it carefully before installing.

Install only if you trust the inference.sh installer endpoint and are comfortable with a remote script running as your user. Prefer the manual download-and-verify path, pin versions where possible, review related skills separately before adding them, and treat prompts, files, API keys, and Twitter/X actions as leaving your local environment when you run `infsh`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installer Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md:14-17` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash ## Install CLI curl -fsSL https://cli.inference.sh | sh infsh login ``` ### Technical Analysis The installation procedure downloads mutable content from `https://cli.inference.sh` and sends it directly to `sh`. The downloaded script is therefore executed before the user can inspect it or verify its integrity. Its effective behavior can change at any time after this Skill has been audited. HTTPS protects transport under ordinary circumstances but does not protect users if the hosting account, web server, DNS configuration, certificate infrastructure, or release pipeline is compromised. The subsequent claim that the installer verifies the CLI binary does not address this trust gap: the unverified installer itself is already running and can bypass or falsify any later verification. This behavior exceeds the minimum privileges necessary to install the CLI because the same document provides a manual download-and-verification procedure. Installation does not inherently require immediate interpretation of a mutable network response. ### Attack Path 1. An attacker compromises the installer endpoint, its hosting infrastructure, DNS, certificate chain, or deployment pipeline. 2. The attacker replaces the installer response with a malicious shell script. 3. A user or agent follows the documented installation command. 4. `curl` retrieves the attacker-controlled response and pipes it directly into `sh`. 5. The payload executes with all permissions available to the invoking account. 6. The payload can read accessible credentials, modify user files, replace executables, or establish persistence without performing the advertised installation. ### Impact Assessment Successful exploitation grants arbitrary command execution with the privileges of the user ...[truncated 461 chars]
• Remediation: ## Remediation Suggestions - Remove the pipe-to-shell installation command. - Require an immutable, version-pinned release artifact rather than a moving “latest” installer. - Download the artifact to disk before execution or installation. - Verify its SHA-256 digest against a value obtained from an independently trusted, versioned source. - Prefer mandatory Sigstore verification rather than making signature verification conditional on whether `cosign` happens to be installed. - Display the resolved URL and version to the user and require explicit approval before installing. - Install only into a user-owned directory such as `~/.local/bin`; do not request elevated privileges. - Avoid `sha256sum --ignore-missing` for security-critical verification. Explicitly identify the expected artifact and fail closed if its checksum entry is absent.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/authentication.md:3
• Finding: Authentication Guide Repeats Unsafe Remote Shell Execution## Vulnerability Details **File Location**: `references/authentication.md:3-7` and `references/authentication.md:39-45` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash ## Install the CLI ```bash curl -fsSL https://cli.inference.sh | sh ``` ``` The same unsafe operation is recommended again for updates: ```bash ## Update CLI ```bash infsh update ``` Or reinstall: ```bash curl -fsSL https://cli.inference.sh | sh ``` ``` ### Technical Analysis Both initial installation and reinstallation execute a mutable response from an external service without prior inspection, version pinning, checksum validation, or signature verification. Recommending the operation as an update mechanism makes the exposure recurring rather than limited to initial setup. Because authentication is performed immediately after installation and the document also supports `INFSH_API_KEY`, a malicious installer could target credentials subsequently used by the CLI or already present in the environment. No credential theft is embedded in the audited files, but arbitrary shell execution gives a compromised installer the technical ability to access any credentials available to the invoking process. ### Attack Path 1. An attacker gains control over the installer response or its delivery chain. 2. A user follows either the installation or reinstallation guidance. 3. The malicious response is passed directly to `sh`. 4. The payload executes under the user's account. 5. It can inspect environment variables, user configuration, and authentication material accessible to that account. 6. During an update, it can replace an existing trusted CLI with a malicious implementation that captures later commands or credentials. ### Impact Assessment The immediate impact is arbitrary code execution under the invoking user's privileges. Accessible API keys, local CLI credentia ...[truncated 390 chars]
• Remediation: ## Remediation Suggestions - Replace both pipe-to-shell examples with a version-pinned manual installation process. - Download the installer or binary to a local file and verify it before any execution. - Publish checksums and signatures through a separately protected, immutable release channel. - Require signature verification and fail closed on an absent or invalid signature. - Use a package manager with signed, versioned packages where practical. - Make updates explicit and version-aware; do not silently reinstall from a mutable endpoint. - Document the exact location and permissions of locally stored credentials. - Recommend short-lived, narrowly scoped API keys and prevent secrets from being exposed in shell history or logs.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/cli-reference.md:3
• Finding: CLI Reference Promotes Direct Execution of a Mutable Network Response## Vulnerability Details **File Location**: `references/cli-reference.md:3-7` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash ## Installation ```bash curl -fsSL https://cli.inference.sh | sh ``` ``` ### Technical Analysis The reference documentation instructs users to interpret data received from an external URL as shell code. There is no local review boundary, immutable version selection, or integrity verification before execution. Consequently, the code that actually runs is not the code reviewed in this project. The operation is unnecessary for the Skill's minimum declared functionality. A downloaded, pinned, and verified CLI artifact can provide the same functionality without granting an unverified network response an immediate code-execution channel. ### Attack Path 1. The external installer or delivery infrastructure is compromised. 2. An attacker serves modified shell commands from the documented URL. 3. A user copies the command from the CLI reference. 4. The response is executed directly by `sh`. 5. The attacker's commands operate with the invoking user's permissions. ### Impact Assessment Exploitation permits arbitrary local command execution as the invoking user. This may allow theft of environment secrets and readable files, modification of user-owned data, installation of malicious binaries, or persistence where the user has sufficient permissions. The audited command does not itself elevate privileges.
• Remediation: ## Remediation Suggestions - Remove the direct `curl | sh` example. - Pin the CLI to a specific reviewed release. - Download the corresponding artifact without executing it. - Verify a cryptographic signature and expected digest before extraction. - Abort installation if the version, signature, checksum, platform, or expected filename does not match. - Install into a non-privileged user directory and clearly document all filesystem changes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82
• Finding: Related Skills Are Installed from Unpinned Third-Party References## Vulnerability Details **File Location**: `SKILL.md:82-108` **Vulnerability Type**: Insecure dependency and Skill supply-chain usage **Risk Level**: Medium **Vulnerable Code**: ```bash ## Related Skills ```bash # Image generation (FLUX, Gemini, Grok, Seedream) npx skills add inference-sh/skills@ai-image-generation # Video generation (Veo, Seedance, Wan, OmniHuman) npx skills add inference-sh/skills@ai-video-generation # LLMs (Claude, Gemini, Kimi, GLM via OpenRouter) npx skills add inference-sh/skills@llm-models # Web search (Tavily, Exa) npx skills add inference-sh/skills@web-search # AI avatars & lipsync (OmniHuman, Fabric, PixVerse) npx skills add inference-sh/skills@ai-avatar-video # Twitter/X automation npx skills add inference-sh/skills@twitter-automation # Model-specific npx skills add inference-sh/skills@flux-image npx skills add inference-sh/skills@google-veo # Utilities npx skills add inference-sh/skills@image-upscaling npx skills add inference-sh/skills@background-removal ``` ``` ### Technical Analysis The commands invoke `npx` without pinning the `skills` runner itself to a reviewed immutable version. They also install related Skills using symbolic names rather than immutable commit hashes or verified release identifiers. Both the executable runner and installed Skill content can therefore change after this audit. Skill packages are particularly sensitive dependencies because their instructions can influence agent behavior and tool use. No malicious content in these related Skills was available in the audited project, so compromise is not established. The confirmed weakness is that the documentation delegates installation to mutable, externally controlled supply-chain components without documented integrity verification. ### Attack Path 1. An attacker compromises the package used by `npx`, the referenced repository or publisher account, or an upstream release process ...[truncated 924 chars]
• Remediation: ## Remediation Suggestions - Pin the `skills` runner to an exact reviewed version rather than invoking an implicit latest version through `npx`. - Pin every related Skill to an immutable commit hash or cryptographically verified release. - Maintain lockfiles or a signed manifest recording the exact runner and Skill revisions. - Verify publisher identity, checksums, and signatures before installation. - Review each related Skill independently, including its allowed tools and external instructions. - Disable package lifecycle scripts where they are unnecessary and supported by the tooling. - Present related Skills as optional dependencies and require explicit user approval before installation. - Re-audit and deliberately update pins rather than automatically following mutable upstream references.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

External Script Fetching

High

• Category: Supply Chain

Content

## Install CLI

```bash
curl -fsSL https://cli.inference.sh | sh
infsh login
```

• Confidence: 98% confidence
• Finding: `curl ... | sh` fetches a remote script and executes it immediately, which is dangerous because any compromise of the server, transport, DNS, or publishing pipeline becomes direct code execution on the user's machine. Although the surrounding text claims checksum and optional signature verification, those protections occur inside the fetched script, so they do not protect against a malicious or tampered installer itself.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Install CLI

```bash
curl -fsSL https://cli.inference.sh | sh
infsh login
```

• Confidence: 97% confidence
• Finding: The `| sh` chain turns a network response directly into shell execution, collapsing retrieval and execution into one step with no independent review boundary. In a skill file, this is especially risky because users may copy-paste it verbatim, making compromise of the remote content immediately exploitable.

External Script Fetching

High

• Category: Supply Chain

Content

## Install the CLI

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Login

• Confidence: 98% confidence
• Finding: This is a direct external script fetch and execution pattern: the content retrieved from the network is immediately executed by the shell without validation. That creates a supply-chain execution path where any compromise of the distribution endpoint or network trust can translate into instant code execution on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Install the CLI

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Login

• Confidence: 96% confidence
• Finding: The shell pipe into `sh` is the dangerous chaining mechanism that turns a network retrieval into immediate execution. In practice, this eliminates the user's chance to review content and makes any upstream compromise materially more dangerous.

External Script Fetching

High

• Category: Supply Chain

Content

Or reinstall:

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Troubleshooting

• Confidence: 98% confidence
• Finding: The reinstall instructions repeat the same unsafe external script execution pattern, creating another documented path for arbitrary code execution from a remote source. Repetition increases exposure because users may run it during troubleshooting, often with reduced scrutiny and elevated privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

Or reinstall:

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Troubleshooting

• Confidence: 96% confidence
• Finding: This repeated `| sh` chaining pattern preserves the same arbitrary-execution risk in the reinstall flow. Because troubleshooting instructions are often copied verbatim, this can normalize unsafe behavior and broaden exploitation opportunities.

External Script Fetching

High

• Category: Supply Chain

Content

## Installation

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Global Commands

• Confidence: 99% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` is a classic remote code execution pattern because it executes whatever content is returned by the remote server directly in the user's shell. In the context of an agent skill that encourages automation and CLI usage, this is especially dangerous because users may run it reflexively or non-interactively, magnifying the blast radius of any compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Installation

```bash
curl -fsSL https://cli.inference.sh | sh
```

## Global Commands

• Confidence: 98% confidence
• Finding: The `| sh` chaining causes unreviewed network content to flow directly into command execution, removing the user's opportunity to inspect what will run. This enables supply-chain compromise, server-side takeover, or content manipulation to become immediate code execution on the installing machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases like `ai model`, `run ai`, `ai api`, and model names that can match many unrelated user requests. Overbroad auto-activation increases the chance the skill is invoked in contexts where its powerful Bash-enabled and external-network behaviors are unnecessary or unsafe.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The description advertises web search, LLM calls, image/video generation, and Twitter/X automation, all of which can transmit user data or affect external accounts, but it does not warn users about those consequences. In skill-selection context, missing disclosure can cause users to invoke the skill without understanding that prompts, files, or account actions may leave the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The skill recommends invoking `npx skills add ...` without pinning an exact package version or immutable source reference. That allows the fetched package content to change over time, so a future compromised or malicious release could execute unexpected code during installation in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: This `npx skills add ...` example installs code from a moving target rather than a pinned version. If the upstream package, tag, or dependency chain is hijacked, users following the documentation could run attacker-controlled code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Using unpinned `npx` installation commands introduces supply-chain risk because the resolved package can differ across time and environments. A compromised maintainer account or dependency could convert this documentation example into remote code execution on install.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The command relies on unpinned `npx skills` behavior, which means the fetched code is not reproducible or stable. That creates a realistic supply-chain exposure for anyone copying the example directly from the skill.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: An unpinned `npx skills add` command can silently pull different code in the future. In a skill file, such copy-pasteable install steps are especially risky because users may run them with minimal scrutiny.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: This installation example does not constrain the version of the package being executed. That increases exposure to upstream compromise, typo/squat issues, or malicious updates that would execute during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Because the `npx` invocation is unpinned, users are trusting the latest resolver output at execution time. That is a classic documentation-induced supply-chain risk with code-execution consequences if the package is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The example references `npx skills` without an exact version, making the installed code mutable over time. That weakens reproducibility and can expose users to malicious package changes or dependency compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: This command demonstrates executing an unpinned package via `npx`, which is a supply-chain hazard in security-sensitive documentation. Anyone following it could execute altered code if the package or publishing account is compromised later.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The use of unversioned `npx skills add` leaves users dependent on whatever code is current when they run the command. In practice, that can enable remote code execution through package takeover or malicious updates.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to pipe a remotely fetched script directly into the shell, which enables arbitrary code execution if the remote host, CDN, DNS, TLS trust chain, or publishing pipeline is compromised. Because this is an installation step for a CLI with authentication and API access, compromise could lead to credential theft or full workstation compromise.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation command instructs users to fetch a remote script over the network and execute it immediately in a shell, without any integrity verification, pinning, or warning. If the hosting domain, transport path, or served script is compromised, users could execute arbitrary attacker-controlled code on their systems.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file includes a file-writing command (`infsh app list --save apps.json`) but does not mention that it will create or overwrite a local file. Under the markdown-specific warning criterion, user-facing documentation should disclose behaviors that affect user data or the local filesystem.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Storing an API key in an environment variable is common, but documenting it without any warning can still expose credentials through shell history, process listings in some environments, CI logs, debug output, or inherited subprocess environments. In a tool that automates many third-party AI services, leaked credentials could enable unauthorized API usage and account abuse.