Ai Video Generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:34 AM UTC
• Version: 0.1.5

Overview

The skill is coherently about AI video generation, but its documentation asks users to run mutable remote installers and unpinned package commands that could execute unreviewed code.

Review before installing. Prefer a pinned, inspectable CLI installation path with independently published checksums or signatures, avoid running the pipe-to-shell command from a privileged shell, and do not submit sensitive prompts, media, private URLs, or account credentials unless you accept inference.sh and model-provider processing. Treat the optional related-skill npx commands as separate installations that need their own review, especially Twitter automation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17
• Finding: Remote Installer Executed Directly Through a Shell Pipeline<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 17 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command retrieves mutable content from `https://cli.inference.sh` and pipes the response directly into `sh`. The remote response is therefore executed before the user can inspect it or independently verify its integrity. Although the document claims that the installer verifies the downloaded CLI binary with SHA-256, that verification is performed by the same unverified remote script being executed. It does not protect against compromise of the installer endpoint or malicious modification of both the binary and expected checksum. HTTPS protects the connection in transit but does not protect against a compromised server, domain, deployment pipeline, or trusted certificate path. Installing the CLI is necessary for the documented functionality, but executing a mutable installer directly from the network is not the minimum-risk installation method. The same functionality can be provided using a version-pinned binary, an independently published signature or checksum, and explicit verification before execution. ### Attack Path 1. An attacker compromises the installer domain, hosting account, deployment pipeline, DNS resolution, or another trusted delivery component. 2. The attacker changes the response returned by `https://cli.inference.sh` to include malicious shell commands. 3. A user follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled response and streams it directly to `sh`. 5. The shell executes the payload with all privileges available to the invoking user. 6. The payload can access user files and credentials, alter shell configuration, download additional malware, or establish persistence. 7. If the user invokes the command from a privi ...[truncated 875 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Direct users to a version-specific release artifact rather than a mutable installer endpoint. 3. Publish SHA-256 checksums through an independently controlled and authenticated release channel. 4. Prefer cryptographic signatures using a documented, pinned signing key. Verify both the signature and signer identity before installation. 5. Show separate download, verification, and installation commands so users can inspect the artifact before execution. 6. Pin the expected CLI version and avoid URLs that silently resolve to the latest release. 7. Explicitly warn users not to run the installation as root or through `sudo`. 8. Consider distributing the CLI through a reputable package manager that supports signed and versioned packages. A safer documented workflow should follow this pattern: ```bash # Example structure; replace placeholders with a pinned release and verified digest. curl -fSLo infsh "https://dist.inference.sh/cli/releases/<PINNED_VERSION>/infsh-<OS>-<ARCH>" echo "<EXPECTED_SHA256> infsh" | sha256sum --check - chmod 0755 infsh install -m 0755 infsh "$HOME/.local/bin/infsh" infsh login ``` The expected checksum must not be retrieved solely from the same mutable endpoint as the artifact during installation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:152
• Finding: Unpinned Third-Party Skill and Package Retrieval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 152-169 **Vulnerability Type**: Insecure dependency and supply-chain handling **Risk Level**: Medium ### Vulnerable Code ```bash # Full platform skill (all 150+ apps) npx skills add inference-sh/skills@inference-sh # Google Veo specific npx skills add inference-sh/skills@google-veo # AI avatars & lipsync npx skills add inference-sh/skills@ai-avatar-video # Text-to-speech (for video narration) npx skills add inference-sh/skills@text-to-speech # Image generation (for image-to-video) npx skills add inference-sh/skills@ai-image-generation # Twitter (post videos) npx skills add inference-sh/skills@twitter-automation ``` ### Technical Analysis These commands invoke `npx` without pinning the `skills` package to a reviewed version. Depending on the local environment and package resolution behavior, `npx` may retrieve and execute current package content from a remote registry. The referenced Skills are also identified using mutable repository and Skill names rather than immutable commit hashes or verified release identifiers. Consequently, the content installed in the future may differ from the content available when this document was audited. There is no evidence in the reviewed file that these upstream packages are currently malicious. The vulnerability is the absence of immutable versioning and integrity controls, which creates a supply-chain attack path if the package registry, repository, maintainer account, or publishing credentials are compromised. The `twitter-automation` recommendation also expands the operational scope beyond AI video generation. A social-media automation Skill may require account credentials and posting permissions that are not necessary for generating videos, conflicting with least-privilege principles. ### Attack Path 1. An attacker compromises the `skills` package, a referenced Skill repository, a maintainer account, or associated publishing credentials. ...[truncated 1567 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` runner to an exact, reviewed version, for example: ```bash npx --yes skills@<EXACT_VERSION> add ... ``` 2. Pin each referenced Skill to an immutable commit hash or signed release rather than a mutable branch, tag, or Skill name. 3. Record and verify integrity hashes for retrieved packages and Skill artifacts. 4. Use package lockfiles where supported and enable deterministic, reproducible installation. 5. Review downloaded Skill content before enabling it or granting tools and credentials. 6. Prefer vendoring a reviewed dependency snapshot when licensing and update processes permit it. 7. Remove the `twitter-automation` recommendation unless social-media posting is explicitly required by the declared functionality. 8. Apply least privilege to every installed Skill: grant only the tools, files, credentials, and network destinations required for its specific task. 9. Establish an update process requiring security review before changing pinned versions or commit hashes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a video with Veo
infsh app run google/veo-3-1-fast --input '{"prompt": "drone shot flying over a forest"}'

• Confidence: 98% confidence
• Finding: The documentation instructs users to execute a remote script directly with `curl ... | sh`, which is a classic unsafe pattern because it runs code fetched over the network without prior inspection. If the hosting endpoint, TLS trust chain, DNS, or upstream distribution is compromised, users could immediately execute attacker-controlled shell code.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad phrases such as 'video generation', 'generate video', and 'ai animation', which are likely to match many normal user requests. Overbroad activation can cause unintended invocation of a skill that sends prompts and media to external services, increasing privacy and misuse risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill does not clearly warn that prompts, images, audio, and video URLs are transmitted to third-party infrastructure for processing. Users may unknowingly disclose sensitive content, proprietary media, or internal URLs to external services, which is especially relevant for a media-generation workflow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: The skill recommends running `npx skills add ...` without pinning an exact package version, which means users may retrieve whatever version is current at execution time. This creates a supply-chain risk because a compromised or malicious future package release could be executed unexpectedly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: This `npx skills add ...` invocation is unpinned and therefore subject to version drift and package supply-chain compromise. Even if the current package is safe, later releases could introduce malicious code or breaking behavior that users execute automatically.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: Using `npx skills` without a pinned version causes the command to resolve dynamically at runtime, exposing users to malicious updates or dependency hijacking. In a skill-distribution context, this is a meaningful supply-chain weakness rather than a purely theoretical issue.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: Because this `npx skills add ...` example is not pinned, users may execute a different package state than the author tested. That undermines reproducibility and opens the door to executing malicious or compromised package content from the registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: An unpinned `npx` invocation is a real supply-chain risk because it delegates trust to the latest available package resolution. If an attacker compromises the package, namespace, or dependency chain, users following the documentation could execute attacker-controlled code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: This command again relies on `npx` without an immutable version, making execution dependent on external package state at the time the user runs it. In documentation intended for broad use, repeated unpinned examples increase exposure to registry and dependency compromise.

Static analysis

No suspicious patterns detected.