App Store Screenshots

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

The skill’s main purpose is coherent, but its install instructions ask users to run mutable remote code directly and optional unpinned package commands.

Review this skill before installing because the recommended setup runs a remote shell installer and optional unpinned npx commands. Prefer downloading and verifying the CLI manually, use pinned package versions where available, and run installation from a low-privilege environment without unnecessary secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Mutable Remote Installer Is Piped Directly Into a Shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:259

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote shell script directly via curl ... | sh, which is a classic high-risk pattern because the downloaded content is executed immediately without an independent review step. Even though the surrounding text claims checksum verification and limited behavior, those assurances are themselves untrusted skill content and do not eliminate the risk of server compromise, script tampering, or malicious updates.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a device mockup scene
infsh app run falai/flux-dev-lora --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list includes broad phrases like "aso," "app preview," "app listing," and "device mockup" without constraints or exclusion conditions. In a manifest file, this can cause unintended invocation for general marketing or design requests that are not specifically about this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language guidance states "Other | English defaults," which imposes a language choice for remaining markets rather than offering a user-selected locale. This can violate language/locale policy when the user has not opted into English output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.