Case Study Writing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

The skill is a coherent case-study writing aid, but it asks users to run mutable remote installation commands and send research queries through external services.

Review before installing. Avoid running the pipe-to-shell installer as written; prefer a pinned release, signature or checksum verification before execution, and inspect any installer first. Do not send customer names, confidential metrics, deal details, or unreleased strategy to external search or executor apps unless you have permission.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installer Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The command downloads mutable content from `https://cli.inference.sh` and immediately passes it to `sh`. The remote response is neither inspected nor authenticated before execution. Consequently, the effective code executed by the command can change after this Skill has been reviewed. The install note claims that the downloaded binary is checked using SHA-256, but this does not authenticate the installer itself. A compromised installer can omit or falsify its verification process, execute unrelated commands, or retrieve additional payloads. The repository does not contain a pinned installer, trusted checksum, or signature against which the remote response can be independently validated. This behavior exceeds the minimum privileges necessary for the declared case-study-writing functionality. Most writing guidance requires no code installation. Even when optional research or visualization features are desired, executing an unreviewed remote script with all privileges of the invoking user is not a least-privilege installation mechanism. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its hosting account, deployment pipeline, DNS resolution, or another relevant delivery component. 2. The attacker replaces the expected installer response with a malicious shell script. 3. A user or automation agent follows the Quick Start command in `SKILL.md`. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to `sh` without review or prior integrity verification. 6. The malicious script executes with the permissions of the invoking user and may retrieve further payloads, inspect local files, steal credentials, or establish persistence. ### Impact ...[truncated 613 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Make external tooling optional because the core writing functionality does not require local code installation. 3. Publish versioned CLI artifacts and require users to download a specific immutable release. 4. Publish expected cryptographic hashes through a trusted, independently protected release channel. 5. Require checksum or digital-signature verification before any downloaded file is executed. 6. Prefer a reputable package manager with pinned versions and package-signing support. 7. Provide a manual installation procedure that allows users to inspect the installer and binary before execution. 8. If an installer remains necessary, run it with least privilege, document every filesystem and network operation, and avoid requesting administrative access. 9. Pin the installer URL to a specific reviewed version rather than serving mutable content from a generic endpoint. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:230
• Finding: Mutable and Unverified Third-Party Skill Installation Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 230–231 **Vulnerability Type**: Insecure third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@web-search npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis These commands use `npx` and mutable third-party Skill references without specifying an immutable package version, commit identifier, integrity hash, or signature. The relevant dependency content is not included in this project and therefore was not available for audit. Depending on package resolution and the behavior of the `skills` utility, following these commands can retrieve and execute package tooling and install external Skill instructions that may change independently after this audit. This creates a supply-chain trust boundary that is not clearly communicated or constrained. The dependencies are presented under “Related Skills” and are not necessary for the declared core functionality. Installing them through executable commands therefore introduces avoidable code and instruction supply-chain exposure. ### Attack Path 1. An attacker compromises the package, repository, publisher account, package-resolution source, or an associated release pipeline. 2. The attacker publishes malicious content under one of the mutable references or compromises the package resolved by `npx`. 3. A user follows one of the documented installation commands. 4. `npx` resolves remote tooling, and the command retrieves the referenced third-party Skill. 5. Malicious package behavior or Skill instructions are installed or executed in the user's environment. 6. The introduced content may execute commands, alter agent behavior, access available data, or direct the installation of additional payloads. ### Impact Assessment The direct impact depends on the behavior and permissions of the remotely resolved tooling and installed Skills. Potential scope includes modi ...[truncated 456 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace executable installation examples with non-executing references unless these optional Skills are actually required. 2. Pin each dependency to an exact audited version or immutable commit hash. 3. Provide integrity hashes or verified signatures for downloaded artifacts. 4. Pin the `skills` command-line package itself rather than allowing `npx` to resolve a mutable version. 5. Use a lockfile or equivalent dependency manifest where supported. 6. Document the source, publisher, required permissions, and expected behavior of every external Skill. 7. Require users to inspect downloaded Skill content before enabling it. 8. Re-audit dependencies whenever pinned versions are updated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Research the customer's industry
infsh app run tavily/search-assistant --input '{

• Confidence: 98% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` executes a remotely fetched script directly in the user's shell, creating a classic supply-chain and remote code execution risk. Even with a later note about checksum verification, the one-line install encourages users to run unreviewed network content before any independent validation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list is broad enough to match ordinary terms like 'case study', 'use case', or 'customer story', which can cause the skill to activate in contexts where the user did not intend external research or tool use. In an agent environment, over-broad activation increases the chance of unnecessary data sharing or unexpected execution paths.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The research examples send business queries to third-party services (`tavily/search-assistant`, later also Exa) without warning that customer names, internal metrics, or strategic context could be transmitted externally. In a case-study workflow, prompts are especially likely to contain confidential client information, making silent exfiltration of business-sensitive data a realistic risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The embedded Python example saves an output file ("results-chart.png") to the local environment, which is a file write affecting user workspace contents. The surrounding documentation does not explicitly warn that running the example will create or overwrite a local file.

Static analysis

No suspicious patterns detected.