ClawHub
Back to skill

Security audit

Ai Music Generation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s music-generation purpose is coherent, but its quick start asks users to run a live internet installer directly in a shell before logging in.

Install only if you trust inference.sh and are comfortable running its installer under your user account. Prefer a manual, version-pinned download with an independently published checksum or signature, run login as a separate step, and review any optional related skills before adding them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:17
Finding

Remote Installer Is Downloaded and Executed Without Independent Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code

bash
# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The installation command streams content from https://cli.inference.sh directly into sh. The effective executable payload is therefore controlled by the remote endpoint and can change after this Skill has been reviewed.

HTTPS protects the connection in transit but does not protect against compromise of the hosting server, deployment pipeline, DNS configuration, or publisher account. It also does not make the downloaded script immutable. If any of these components are compromised, the returned script can execute arbitrary commands under the account running the installation.

The document states that the installer downloads a platform-specific binary and verifies its SHA-256 checksum. However, this does not establish an independent trust boundary because the remotely supplied installer controls both the artifact selection and the verification process. A malicious installer could omit verification, substitute the expected digest, or execute another payload.

Immediate remote shell execution is not the minimum privilege or minimum-risk mechanism necessary to provide music generation. A version-pinned binary can instead be downloaded, independently verified, and installed without executing a mutable installer script.

Attack Path

  1. An attacker compromises or gains control of cli.inference.sh, its deployment pipeline, DNS, or a relevant publisher account.
  2. The attacker modifies the installer response to include arbitrary shell commands.
  3. A user or agent follows the documented Quick Start command.
  4. curl retrieves the attacker-controlled response.
  5. The pipe sends the response directly to sh, which executes it wit ...[truncated 1010 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | sh installation command.
  2. Pin the CLI to a specific released version rather than retrieving a mutable latest installer.
  3. Use a versioned, immutable artifact URL.
  4. Download the artifact to a local file without executing it.
  5. Publish the expected SHA-256 digest in reviewed, version-controlled Skill content or verify a cryptographically signed release through a separately trusted key.
  6. Compare the downloaded artifact against the independently obtained digest before installation.
  7. Install only the verified binary, using user-level directories and without elevated permissions.
  8. Display authentication as a separate command so installation failure or binary substitution cannot be conflated with login.
  9. Prefer a trusted package manager that supports exact version and integrity pinning where available.

A safer documented flow should follow this pattern:

bash
curl -fL -o infsh <versioned-artifact-url>
printf '%s  %s\n' '<reviewed-sha256>' 'infsh' | sha256sum --check -
install -m 0755 infsh "$HOME/.local/bin/infsh"
infsh login

The versioned URL and expected digest must be replaced with values independently verified and maintained in the reviewed Skill.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:105
Finding

Related Skills Are Installed Through Unpinned Third-Party References

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105–111
Vulnerability Type: Unpinned third-party dependency and Skill installation
Risk Level: Medium

Vulnerable Code

bash
# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@inference-sh

# Text-to-speech
npx skills add inference-sh/skills@text-to-speech

# Video generation (add music to videos)
npx skills add inference-sh/skills@ai-video-generation

Technical Analysis

These optional commands invoke npx and install content using references that are not pinned to immutable package versions, commit identifiers, or integrity hashes. The referenced content and the dependency graph used by npx are not included in the audited project, so their behavior cannot be verified from this repository.

Mutable references can resolve to different content over time. Compromise of an upstream publisher account, repository, package, release process, or transitive dependency could cause a previously benign command to retrieve hostile code or malicious Skill instructions.

This issue is distinct from the primary music-generation functionality. Installing additional Skills is optional and is not necessary to operate the declared music-generation Skill, so recommending mutable dependency installation expands the trust boundary beyond the minimum required scope.

Attack Path

  1. An attacker compromises an upstream package, repository, maintainer account, release process, or transitive dependency used by npx or one of the referenced Skills.
  2. The attacker publishes malicious content under a reference used by one of the documented commands.
  3. A user follows the Related Skills recommendation.
  4. npx resolves and retrieves the current upstream content rather than a reviewed immutable revision.
  5. Installation logic adds the compromised Skill or executes applicable package tooling.
  6. The malicious component subsequently ru ...[truncated 780 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npx package itself to an exact reviewed version instead of relying on implicit latest-version resolution.
  2. Pin every related Skill to an immutable commit identifier or exact release version.
  3. Where supported, require package integrity hashes or signed release verification.
  4. Review the complete contents and requested tool permissions of each related Skill before installation.
  5. Use an installation mode that does not automatically execute unreviewed lifecycle scripts.
  6. Vendor reviewed Skill definitions when practical and record their provenance.
  7. Remove these optional commands from the primary Quick Start path and clearly state that they introduce separate third-party trust boundaries.
  8. Re-audit dependencies whenever pinned versions or commit identifiers are updated.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill instructs users to execute a remote shell script directly via curl ... | sh, which is a classic unsafe installation pattern because it grants immediate code execution to whatever the remote server returns at runtime. Even though the document claims checksum verification and benign behavior, users cannot safely validate those assurances before executing the fetched script, so compromise of the host, CDN, or delivery path could lead to arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash
# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a song
infsh app run infsh/diffrythm --input '{"prompt": "upbeat electronic dance track"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes generic phrases such as "generate song," "create music with ai," and "ai music," which are broad enough to match ordinary user intent outside a narrowly defined invocation context. The manifest does not provide exclusion conditions or scope limits to reduce accidental activation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.