Security audit
Security checks for vulnerabilities and agentic risk
This AI workflow skill is coherent, but it recommends unsafe installation and under-scoped automation patterns that can run repeatedly or send raw outputs outside your environment.
Install only after reviewing the installer source and using pinned, verified downloads instead of curl-to-shell or unpinned npx. If you use the automation examples, run them under a low-privilege account, set spending and storage limits, keep cron scripts in protected paths, know how to remove scheduled jobs, and redact webhook alerts so prompts, outputs, tokens, and file paths are not sent externally.
SKILL.md:16Unverified Remote Installer Executed Directly by a Shell
SKILL.md:186Recurring Workflow Execution Through User Crontab
SKILL.md:263Workflow Output and Command Arguments Exposed to an Alert Webhook
SKILL.md:388Unpinned Remote Skill Installation Through npx
curl -fsSL https://cli.inference.sh | sh pipes a remote script directly into the shell, creating immediate arbitrary code execution if the host, CDN, TLS path, or served script is compromised. The nearby note about checksum verification does not mitigate the risk for this exact one-liner because the script itself is executed before the user independently verifies anything.
curl -fsSL https://cli.inference.sh | sh && infsh login
# Simple automation: Generate daily image
infsh app run falai/flux-dev --input '{
The trigger list in the manifest-style front matter includes broad phrases such as "batch processing," "automated content," and "automation script" without clear scope boundaries or exclusion conditions. Because this is a markdown/manifest context, these vague triggers could cause unintended activation for generic workflow or content requests.
The scheduled automation examples create recurring jobs and write outputs/logs to disk without prominently warning about unattended execution, file growth, or repeated external API use. In practice, this can lead to persistent background activity, unexpected costs, storage consumption, and unattended processing of sensitive data.
Using crontab -e establishes persistent scheduled execution, which can continue running unattended after the initial session ends. In an automation skill, persistence increases risk because mistakes, unexpected prompts, or compromised scripts can repeatedly execute and generate ongoing network calls, file writes, or costs.
# Edit crontab
crontab -e
# Daily content generation at 9 AM
0 9 * * * /path/to/daily_content.sh >> /var/log/ai-automation.log 2>&1
The webhook alerting example sends command output and command context to an external endpoint but does not clearly warn that failures may include prompts, model responses, file paths, tokens, or other sensitive content. This omission makes accidental data disclosure more likely, especially in automation contexts where logs and stderr often contain secrets.
The curl -X POST alert transmits error and command fields to an external webhook, which is a direct exfiltration path. Since command output often contains sensitive operational details or secrets, a failed run could leak internal data outside the environment.
if [ $status -ne 0 ]; then
# Send alert (webhook, email, etc.)
curl -X POST "https://your-webhook.com/alert" \
-H "Content-Type: application/json" \
-d "{\"error\": \"$result\", \"command\": \"$*\"}"
fi
The skill declares only Bash(infsh *) as an allowed tool scope, but the example uses arbitrary curl to POST data to an external webhook. That broadens capability beyond the declared boundary and could mislead users or downstream systems into approving behavior that includes uncontrolled network exfiltration.
The Python example invokes subprocess.run(...), which is broader than the skill's declared infsh-only command capability. This mismatch weakens trust boundaries because users may assume the skill is restricted when it actually demonstrates a general-purpose command execution pattern.
The skill recommends running npx skills add ... without pinning an exact package version, which allows whatever version is current at execution time to be fetched and run. This creates a supply-chain risk because a compromised or maliciously updated package could execute unexpected code on the user's system.
This npx skills add ... invocation is unpinned, so it resolves code dynamically from the registry at runtime. If the package or dependency chain is tampered with, users may execute attacker-controlled code simply by following the example.
An unversioned npx skills command introduces nondeterministic code execution and supply-chain exposure. Because npx may download and run a package immediately, the example normalizes executing mutable remote code.
Referencing npx skills without a pinned version leaves the runtime package selection open-ended and vulnerable to package compromise, typo-squatting, or malicious updates. In a skill intended for automation, this risk is amplified because users may run setup commands quickly and repeatedly.
No suspicious patterns detected.