ClawHub
Back to skill

Security audit

Background Removal

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly about image background removal, but it tells users to run mutable remote installers and optional unpinned skill installs that expand trust beyond the stated task.

Review this skill before installing. Prefer a manual, version-pinned CLI download with checksum or signature verification performed before execution, and avoid the optional broad npx skill installs unless you intentionally want those extra remote skills and trust their publisher.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unpinned Remote Installer Is Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The quick-start command downloads a mutable script from https://cli.inference.sh and passes it directly to sh. The remote content is therefore executed before the user can inspect it, and no installer version, immutable digest, or locally verified signature is specified.

The document states that the installer detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum. That downstream check does not secure the bootstrap script itself: the remotely delivered script can execute arbitrary commands before, instead of, or in addition to the documented verification process.

HTTPS protects the connection under normal conditions but does not make the delivered payload immutable. A compromise of the hosting domain, web application, CDN, deployment credentials, or signing infrastructure could change the effective code after this skill has been reviewed. Direct shell execution is not necessary for the declared background-removal functionality and introduces a broader code-execution channel than the task requires.

Attack Path

  1. An attacker compromises, or otherwise gains the ability to alter, content served by cli.inference.sh or its delivery infrastructure.
  2. The attacker replaces the expected installer with a script containing arbitrary shell commands while optionally retaining normal installation behavior.
  3. A user or agent follows the documented quick-start command.
  4. curl retrieves the modified content and streams it directly to sh.
  5. The malicious commands execute immediately with the permissions of the user running the skill.
  6. The attacker may then install a modified infsh binary, read user-accessible fi ...[truncated 747 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the curl | sh installation path from the quick-start instructions.
  • Publish versioned CLI artifacts at immutable release URLs and require users to download the artifact separately.
  • Publish a fixed SHA-256 digest or, preferably, a cryptographic signature through an independently authenticated release channel.
  • Require checksum or signature verification before making the binary executable or running any installer.
  • Pin the documented CLI version rather than retrieving the latest mutable installer.
  • Document the exact files, directories, environment settings, and network endpoints used by installation.
  • Ensure installation is performed without sudo or equivalent elevation and fails if elevation is unexpectedly requested.
  • Offer package-manager installation only through a reviewed, signed, and versioned repository.

A safer documented sequence should separate download, verification, and execution, for example:

bash
curl -fL -o infsh.tar.gz https://trusted.example/releases/infsh-VERSION-PLATFORM.tar.gz
echo "EXPECTED_SHA256  infsh.tar.gz" | sha256sum -c -
# Extract and install only after successful verification.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:68
Finding

Optional Skill Installation Commands Use Unpinned Remote Packages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-77
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code:

bash
# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@inference-sh

# Image generation
npx skills add inference-sh/skills@ai-image-generation

# FLUX models (including inpainting)
npx skills add inference-sh/skills@flux-image

# Upscaling
npx skills add inference-sh/skills@image-upscaling

Technical Analysis

These optional commands instruct users to retrieve and install third-party skill content using mutable symbolic references. No reviewed version, release digest, or immutable commit is specified. Consequently, the content installed in the future may differ from the content that was available when this project was audited.

The commands are not required for the declared background-removal workflow, which already uses infsh app run. They unnecessarily expand the dependency and trust surface to additional remote skill packages, including a broad package described as containing more than 150 applications.

The audit history does not establish that the referenced packages are currently malicious. The security issue is that their future contents are not constrained by an immutable version or integrity check, creating a supply-chain path through which modified package content could be introduced.

Attack Path

  1. An attacker compromises the upstream repository, maintainer account, package-resolution infrastructure, or a mutable referenced release.
  2. The attacker modifies one of the referenced skills to include harmful instructions or executable content.
  3. A user follows one of the documented npx skills add commands.
  4. The command resolves and installs the current remote content rather than a previously reviewed immutable revision.
  5. The added skill may subsequently influence agent behavior or execute commands a ...[truncated 665 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove unrelated optional skill-installation commands from this narrowly scoped background-removal skill.
  • If related skills must be documented, pin each dependency to a reviewed immutable version or commit identifier.
  • Provide expected integrity hashes or signed release metadata and verify them before installation.
  • Avoid recommending the broad “all 150+ apps” package when only a specific image-processing capability is needed.
  • Document the permissions and tools requested by each dependency so users can make a least-privilege decision.
  • Re-audit dependency updates before changing pinned versions.
  • Prefer a lockfile or equivalent resolution record where the skill manager supports one.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote script directly via curl ... | sh, which gives code fetched at runtime immediate shell execution. Even with the adjacent claim about checksum verification, this pattern bypasses independent review and creates a high-impact supply-chain risk if the endpoint, transport, or publishing pipeline is compromised.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

infsh app run infsh/birefnet --input '{"image_url": "https://your-photo.jpg"}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a narrowly scoped skill for removing backgrounds with the BiRefNet model, but the file's operational guidance shifts to using falai/reve for arbitrary image editing and falai/flux-dev-lora for image generation. Those documented operations go beyond simple background removal and change the effective behavior users are instructed to invoke.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The output section states that the skill returns a PNG with transparent background, yet preceding examples use falai/reve to change the background to a beach and demonstrate broader editing behavior rather than guaranteed transparent output. This creates a direct contradiction between the documented result and the actual documented usage.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.