Ai Content Pipeline

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:52 PM UTC
• Version: 0.1.5

Overview

The skill fits its AI media-pipeline purpose, but users should review it because it recommends mutable remote install commands that can execute code or install other skills without version pinning.

Review the installer and related-skill commands before running them. Prefer a pinned release, checksum or signature verification performed before execution, and a non-administrative environment. Avoid sending confidential drafts, private media, secrets, or regulated data through the pipeline unless you have reviewed inference.sh and the underlying providers' privacy and retention terms.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unpinned Remote Installer Is Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The installation command streams a mutable response from https://cli.inference.sh directly into sh. The downloaded installer is neither saved for inspection nor pinned to a specific immutable version or digest before execution.

The document states that the installer verifies the SHA-256 checksum of the CLI binary. However, that does not establish the integrity of the installer itself: the remote script must execute before it can perform the claimed binary verification. HTTPS protects the connection in transit but does not protect against compromise of the hosting service, deployment pipeline, domain, or publishing account.

This behavior is not necessary for the Skill's declared content-pipeline functionality. A manually downloaded, version-pinned, independently verified CLI binary would provide the required functionality with less supply-chain exposure. The behavior also grants the remote endpoint substantially broader authority than the declared infsh command usage requires.

Attack Path

1. An attacker compromises or gains control over the installer endpoint, its publishing pipeline, or an equivalent trusted delivery component.
2. The attacker changes the response from https://cli.inference.sh to include arbitrary shell commands.
3. A user or automation agent follows the documented Quick Start command.
4. curl streams the attacker-controlled response directly to sh.
5. The payload executes immediately with the privileges and environment of the invoking user.
6. The payload can access resources available to that user before optionally installing the legitimate CLI to conceal the compromise.

Impact Assessment

Successful exploitation ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern.
2. Link to a specific, immutable CLI release rather than a mutable installer endpoint.
3. Require users to download the release artifact without executing it:

   bash

   curl -fL -o infsh https://example.invalid/releases/<fixed-version>/infsh-<platform>
   

4. Publish the expected SHA-256 digest through an independently protected release channel and require verification before installation:

   bash

   echo '<expected-sha256>  infsh' | sha256sum -c -
   

5. Document manual installation into a user-owned directory without sudo.
6. Where supported, provide signed release artifacts and document signature verification.
7. Separate installation from authentication so that users can inspect and verify the installed binary before running infsh login.
8. Advise users to perform installation in a restricted, non-administrative environment.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Related Skills Are Installed from Unpinned Third-Party References

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 235-246
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Video generation models
npx skills add inference-sh/skills@ai-video-generation

# Image generation
npx skills add inference-sh/skills@ai-image-generation

# Text-to-speech
npx skills add inference-sh/skills@text-to-speech

# LLM models for scripts
npx skills add inference-sh/skills@llm-models

Technical Analysis

These commands install related skills using mutable names rather than immutable versions or commit identifiers. A future change to the referenced source can therefore alter what is installed without any corresponding change to this audited SKILL.md.

The commands also invoke npx, which can retrieve and execute package tooling when it is not already available locally. The audited file supplies no integrity hashes, trusted commit identifiers, review procedure, or verification step for either the installer tooling or the referenced skills.

Installing these related skills is optional and is not required for the core pipeline examples, which already use the infsh CLI directly. Presenting mutable installation commands expands the supply-chain trust boundary beyond the minimum required functionality.

Attack Path

1. An attacker compromises a referenced repository, release process, publishing account, or dependency used by the installation tooling.
2. Malicious content is published under one of the mutable skill references or through tooling obtained by npx.
3. A user follows a documented npx skills add command at a later time.
4. The command resolves the then-current remote content rather than an artifact identical to the one originally reviewed.
5. The altered skill is installed and may subsequently influence agent instructions or execute behavior according to the capabilities granted to that skill.

Imp

...[truncated 610 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each related skill to a specific immutable commit digest or cryptographically identified release.
2. Pin the skills installation tool to a reviewed version rather than allowing npx to resolve mutable tooling.
3. Use lockfiles and integrity metadata where the package ecosystem supports them.
4. Review the complete contents and declared tool permissions of every related skill before installation.
5. Document the expected publisher, repository, version, commit, and checksum for each dependency.
6. Treat related skills as optional and avoid installing them unless their functionality is specifically required.
7. Perform installation with a non-administrative account and in an isolated environment where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The command curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a classic unsafe installation pattern. Even with a reassuring note below, users are encouraged to trust network-delivered code before inspecting it, so compromise of the host, TLS termination, CDN, or script publication path could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Simple pipeline: Generate image -> Animate to video
infsh app run falai/flux-dev --input '{"prompt": "portrait of a woman smiling"}' > image.json

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description includes generic triggers such as "content creation," "ai workflow," "generate and edit," and "content automation." These phrases are broad enough to match common user intents outside this specific skill, and the file does not provide limiting context or negative examples to narrow when invocation should occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill quickly moves into examples that send prompts, text, images, audio, and URLs to external services, but it does not clearly warn users about that data flow up front. In a content-pipeline skill this matters because users may supply proprietary drafts, personal media, or confidential materials and not realize they are being transmitted to third-party network services.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.