Ai Social Media Content

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:34 AM UTC
• Version: 0.1.5

Overview

The skill mostly matches its social media content purpose, but it asks users to run mutable remote installers and includes public posting and additional unpinned installs that need careful review.

Review this skill before installing. Prefer a manual, pinned, independently verified installation of the inference.sh CLI instead of running the pipe-to-shell command, avoid unpinned related-skill installs unless you trust and inspect them, and require explicit confirmation before any Twitter/X posting action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Mutable Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The command retrieves the current response from https://cli.inference.sh and pipes it directly to sh. The payload is neither pinned to an immutable version nor saved for inspection before execution. No independently trusted signature or hard-coded checksum is validated before the shell interprets the response.

Although the documentation states that the installer verifies the downloaded binary's SHA-256 checksum, that does not establish trust in the installer itself. A compromised installer can alter both the downloaded artifact and its verification logic. The effective code can also change after this Skill has been reviewed.

Installing a CLI supports the declared content-generation functionality, but executing a mutable network response directly in a shell exceeds the minimum mechanism necessary. A pinned binary can instead be downloaded and independently verified before execution.

Attack Path

1. An attacker compromises the installer host, its deployment credentials, DNS resolution, TLS termination, or another component capable of changing the response from cli.inference.sh.
2. The attacker replaces the expected installer with a malicious shell payload.
3. A user or Agent follows the Quick Start command in SKILL.md.
4. curl downloads the attacker-controlled response and passes it directly to sh.
5. The payload executes immediately with all privileges available to the invoking user.
6. The subsequently installed or replaced infsh binary can also intercept infsh login and capture authentication material.

Impact Assessment

Successful exploitation provides arbitrary command execution under the account running the installation comman ...[truncated 437 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | sh installation pattern.
• Pin the CLI to an exact reviewed version and immutable artifact URL.
• Download the artifact to a local file without executing it.
• Verify it using a hard-coded SHA-256 digest obtained through a separately trusted channel, or validate a cryptographic signature against a pinned trusted public key.
• Fail closed if verification does not succeed.
• Inspect the downloaded file and its permissions before installation or execution.
• Install the CLI in a user-owned directory without elevated privileges.
• Keep manual installation and verification as the default documented procedure.
• Perform authentication only after verifying that the expected CLI binary is being invoked.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Unpinned Third-Party Package Execution and Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:235-247
Vulnerability Type: Insecure dependencies and mutable supply-chain content
Risk Level: Medium

Vulnerable Code:

bash

# Video generation
npx skills add inference-sh/skills@ai-video-generation

# Image generation
npx skills add inference-sh/skills@ai-image-generation

# Twitter automation
npx skills add inference-sh/skills@twitter-automation

# Text-to-speech for voiceovers
npx skills add inference-sh/skills@text-to-speech

# Full platform skill
npx skills add inference-sh/skills@inference-sh

Technical Analysis

These instructions invoke npx skills without an exact reviewed package version or integrity value. Depending on the local environment, npx can retrieve and execute package content resolved at invocation time. Each referenced Skill is also identified by a mutable repository-style name rather than a reviewed commit hash or immutable release artifact.

Consequently, the code and instructions installed by these commands may differ from what existed when this project was audited. Neither the npm package nor the additional Skills are included in the reviewed project, and the instructions do not require inspection or explicit approval of fetched content.

Installing related Skills is optional and is not required for the core social-media generation examples. Automatically retrieving mutable dependencies therefore expands the trust boundary beyond the minimum necessary for the declared functionality.

Attack Path

1. An attacker compromises the package used by npx, its publisher account, the package registry path, or one of the referenced Skill repositories.
2. The attacker publishes malicious package code or modifies a referenced Skill.
3. A user follows one of the “Related Skills” installation commands.
4. npx resolves the current package content and may execute it locally.
5. The package retrieves and installs t ...[truncated 770 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to an exact reviewed version rather than relying on dynamic resolution.
• Enforce npm integrity verification and a trusted lockfile where supported.
• Pin every related Skill to a specific reviewed commit hash or immutable signed release.
• Review downloaded package code and Skill instructions before installation.
• Require explicit user confirmation before executing package code or enabling an additional Skill.
• Run installation in an isolated, non-privileged environment with minimal filesystem and credential access.
• Remove optional installation commands from the primary workflow, or present them as non-executable references with clear supply-chain warnings.
• Periodically re-audit pinned dependencies before upgrading them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

curl -fsSL https://cli.inference.sh | sh executes a remote script directly from the network, creating a classic supply-chain and remote code execution risk. Even with accompanying claims about checksum verification, piping a fetched script into sh prevents users from reviewing the installer first and makes compromise of the hosting or delivery path immediately dangerous.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a TikTok-style video
infsh app run google/veo-3-1-fast --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad terms such as reels, shorts, viral content, and content creator, which can cause the skill to be invoked in contexts where the user did not intend it. Because the skill exposes Bash-based tooling and external-service workflows, overbroad activation increases the chance of accidental execution of networked or side-effecting operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims to be for content generation but also includes a workflow that can post directly to Twitter/X via twitter/post-tweet. That expands the capability from local content creation to external side effects, which can cause unintended publication, account misuse, or reputational damage if invoked without clear user intent and confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The Twitter/X posting example sends generated content to an external platform but does not warn users that content and media URLs will be transmitted outside the local environment. In a content-generation skill, that omission is more dangerous because users may expect creation assistance, not publication to a third-party service.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.