Ai Product Photography

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:34 AM UTC
• Version: 0.1.5

Overview

The skill’s product-image workflow is coherent, but its setup instructions execute a live remote installer and recommend unpinned optional skill installs.

Review this before installing. Prefer a manually downloaded, version-pinned `infsh` release with an independently verified checksum or signature, and avoid the `curl | sh` and unpinned `npx skills add` commands unless you trust those publishers and registries. Use a least-privileged environment and do not log in with production credentials unless you accept the external service’s data handling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command downloads a mutable script from `https://cli.inference.sh` and sends it directly to `sh`. The user has no opportunity to inspect the retrieved content before execution, and the command does not pin a release, verify the installer against an independently obtained digest, or validate a cryptographic signature. The documentation states that the installation script detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum. However, this verification is performed by the same unverified remote script being executed. If that script is compromised, it can omit or falsify the binary verification step. Executing a live remote installer is not required for the Skill's declared product-image generation functionality. A manually downloaded, pinned, and independently verified CLI would provide the necessary functionality with substantially less supply-chain exposure. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its deployment pipeline, hosting account, DNS configuration, or another component of its delivery path. 2. The attacker modifies the installer response to include malicious shell commands. 3. A user or agent follows the Quick Start instructions. 4. `curl` retrieves the attacker-controlled response and pipes it directly into `sh`. 5. The malicious commands execute with all permissions available to the invoking user. 6. The payload can access user-readable data, alter user-writable files, steal credentials available to the process, install additional software, or retrieve further payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account that runs the ins ...[truncated 771 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern from the primary installation instructions. 2. Pin the CLI to a specific reviewed release rather than downloading the latest mutable installer. 3. Download the CLI artifact without executing it: - Select the expected operating-system and architecture artifact explicitly. - Save it to a local file. - Refuse redirects to unexpected hosts. 4. Verify the artifact using a SHA-256 digest obtained through an independent trusted channel. Prefer a cryptographically signed release manifest over an unsigned checksum file hosted beside the artifact. 5. Inspect the downloaded artifact and installation procedure before granting execute permission. 6. Install the executable into a user-scoped directory with minimal permissions; do not request administrator or root privileges. 7. Document the domains contacted, files created, authentication storage location, and uninstall procedure. 8. If an installer script remains available, present it only as a secondary convenience option accompanied by an explicit remote-code-execution warning, rather than as the default Quick Start command. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:247
• Finding: Unpinned Third-Party Package and Skill Installation Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:247-259` **Vulnerability Type**: Unpinned executable dependencies and mutable Skill sources **Risk Level**: Medium ### Vulnerable Code ```bash # Image generation models npx skills add inference-sh/skills@ai-image-generation # FLUX specific npx skills add inference-sh/skills@flux-image # Image upscaling npx skills add inference-sh/skills@image-upscaling # Background removal npx skills add inference-sh/skills@background-removal # Full platform skill npx skills add inference-sh/skills@inference-sh ``` ### Technical Analysis These commands invoke `npx skills` without pinning the `skills` package to a reviewed immutable version or verifying its integrity. Depending on the local environment, `npx` may download and execute package content from a package registry. The referenced Skills are also identified by mutable repository and Skill names rather than immutable reviewed commit hashes. Their contents are not included in the audited project, so their behavior, permissions, and future changes cannot be assessed from this repository. This creates two supply-chain trust points: 1. The executable package invoked through `npx`. 2. The externally sourced Skills installed by that package. The related Skills are optional and are not necessary for the primary image-generation examples. Recommending their direct installation without pinning or review expands the trusted code and instruction surface beyond the minimum required by the declared functionality. ### Attack Path 1. An attacker compromises the package used by `npx`, the associated registry account, the referenced Skill repository, or its publishing workflow. 2. The attacker publishes a malicious package version or modifies one of the mutable referenced Skills. 3. A user follows one of the documented Related Skills commands. 4. `npx` retrieves or runs the unpinned package, which then retrieves and installs the selected external Skill. 5. Mali ...[truncated 1129 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` CLI package to a specific reviewed version and use the package manager's lockfile and integrity metadata. 2. Avoid automatic `npx` downloads where possible; install the reviewed CLI through a controlled dependency-management process. 3. Pin each external Skill to an immutable reviewed commit hash or signed release. 4. Verify package signatures or integrity hashes before execution and Skill installation. 5. Review each referenced Skill's instructions, scripts, allowed tools, network behavior, and requested permissions before enabling it. 6. Install optional Skills separately rather than including installation commands in the primary workflow. 7. Use an allowlist for trusted package registries, repository owners, download domains, and Skill identifiers. 8. Run package and Skill installation in a sandbox or least-privileged environment without access to production credentials. 9. Record the exact reviewed versions and establish an explicit update process requiring security review before changing them. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate product shot
infsh app run falai/flux-dev --input '{

• Confidence: 98% confidence
• Finding: Piping a remotely fetched script directly into `sh` executes network-supplied code immediately, creating a classic arbitrary code execution and supply-chain compromise risk. Even though the document claims checksum verification and benign installer behavior, users cannot safely validate those assurances before execution because the fetched script itself is what gets executed first.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.