Book Cover Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

The skill is mostly coherent for AI-assisted book cover design, but it asks users to run mutable remote installers that can execute code or install unreviewed skills.

Review before installing. The design guidance is normal for this purpose, but avoid copying the curl-to-sh installer or unpinned npx skill-install commands unless you trust the publisher and have an independently verified version, checksum, or signature. Do not submit confidential manuscript details, unpublished artwork, or sensitive personal images to the external AI services without reviewing their data handling terms.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Mutable Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start downloads a mutable response from `https://cli.inference.sh` and immediately executes it with `sh`. There is no opportunity to inspect the installer before execution, no immutable version is selected, and no independently pinned checksum or signature is verified before the script runs. The note at line 24 states that the installer verifies the checksum of the downloaded CLI binary. That does not protect the bootstrap process itself: the remotely supplied shell script is already executing and could omit or bypass its advertised verification behavior. Its contents may also change after this Skill has been reviewed. This installation behavior exceeds the minimum privilege needed to provide book-cover design guidance. Although installation of the `infsh` client supports the AI-generation workflow, executing an unreviewed remote script is not necessary; the client can be distributed through a versioned, independently verifiable installation process. ### Attack Path 1. An attacker compromises the installer domain, CDN, hosting account, DNS resolution, TLS endpoint, or release pipeline. 2. The response served from `https://cli.inference.sh` is replaced with a malicious shell script. 3. A user follows the documented Quick Start command. 4. `curl` retrieves the modified response and pipes it directly to `sh`. 5. The malicious response executes with all permissions available to the invoking user or Agent. 6. The payload can access readable files, modify writable resources, invoke network services, or install additional components before optionally presenting a legitimate login flow. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account ...[truncated 606 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl ... | sh` installation pattern. 2. Direct users to a versioned release artifact on an official, authenticated release page. 3. Pin an exact CLI version rather than downloading the current mutable version. 4. Download the artifact to a local file without executing it. 5. Verify its SHA-256 digest against a digest pinned in reviewed documentation, or preferably verify a release signature against a trusted public key. 6. Execute or install the artifact only after successful independent verification. 7. Publish the installer source and encourage inspection before execution. 8. Keep authentication separate from installation so users can review installation results before running `infsh login`. 9. Document what data `infsh login` and subsequent generation requests transmit to the external service. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:212
• Finding: Unpinned Third-Party Skills Are Installed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 212-214 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@prompt-engineering npx skills add inference-sh/skills@image-upscaling ``` ### Technical Analysis The related-Skill commands invoke tooling through `npx` and identify the requested Skills using mutable names rather than reviewed, immutable versions or commit hashes. No integrity digest or signature is provided. Consequently, the content installed when these commands are executed can differ from the content available when this Skill was audited. The commands also expand the Agent's installed capabilities beyond the declared book-cover workflow. These related Skills are optional and are not required for the documented `infsh app run` examples, making the added supply-chain exposure unnecessary for the core functionality. The reviewed project does not prove that the named upstream components are currently malicious. The vulnerability is the unsafe, unpinned trust relationship and execution or installation path. ### Attack Path 1. An attacker compromises the package/tool distribution path used by `npx`, the referenced Skill repository, a maintainer account, or an upstream release process. 2. The attacker publishes altered tooling or modifies one of the mutable related-Skill references. 3. A user copies one of the documented `npx skills add` commands. 4. `npx` resolves and runs the relevant remote tooling, which then resolves the unpinned Skill content. 5. Unreviewed or attacker-controlled content is installed into the user's Agent environment. 6. The added content may execute when invoked or may influence later Agent sessions according to the capabilities granted by the Skill platform. ### Impact Assessment The immediate scope includes modification of the user's Skill or A ...[truncated 590 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the optional installation commands unless the related Skills are necessary for the declared workflow. 2. Pin the `npx` package/tool to an exact reviewed version. 3. Pin each related Skill to an immutable commit, release identifier, or content digest. 4. Use package-lock or equivalent integrity metadata where supported. 5. Verify signatures or hashes before adding third-party Skill content. 6. Require explicit user approval and display the source, version, requested permissions, and expected functionality before installation. 7. Audit each related Skill independently before recommending it. 8. Avoid granting newly installed Skills shell, filesystem, credential, or network access unless those permissions are demonstrably required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a thriller cover concept
infsh app run falai/flux-dev-lora --input '{

• Confidence: 98% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` fetches remote content and immediately executes it in the shell, which is a classic high-risk pattern. If the remote host, delivery path, DNS, TLS termination, or upstream publishing process is compromised, arbitrary code can run on the user's machine with the user's privileges.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description advertises triggers such as "book cover" and especially "cover design," which are broad natural-language phrases without constraints or exclusion conditions. In a skill-routing context, this can cause unintended invocation for general design discussions rather than explicit requests for this specific workflow.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill requests broad `Bash(infsh *)` access even though its purpose is mainly design guidance and invoking a specific CLI. Granting shell capability beyond the minimum required increases the blast radius if the skill is misused, modified, or if command inputs become attacker-controlled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples send prompts and, later in the skill, local image files to external AI services without a prominent privacy/data-handling warning. Users may unknowingly transmit sensitive manuscript concepts, proprietary artwork, or personal data to third-party services with different retention and training policies.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill recommends `npx skills add ...` without pinning an exact package version or commit, so execution depends on whatever package state is current at install time. That creates a supply-chain risk: a compromised publisher account, dependency, or future malicious release could cause users to install and run unintended code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: This `npx skills add ...` invocation is unpinned, which means users may fetch and execute a moving target rather than a reviewed artifact. In a skill file, that is especially risky because users may trust the instruction and run it directly, enabling supply-chain compromise if the referenced package changes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: Referencing `npx skills` without version pinning exposes users to unreviewed future changes in the package and its dependency chain. Even if the current package is safe, later updates or account compromise could turn this command into arbitrary code execution on the user's system.

Static analysis

No suspicious patterns detected.