T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:14- Finding
Unpinned Remote Installer Executed Directly by Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Competitor Teardown
Security checks for vulnerabilities and agentic risk
Overview
The skill’s competitive-research purpose is coherent, but its setup instructions ask users to execute mutable remote installers and unpinned skill installs.
Review this skill before installing. Use a pinned, independently verified installer for the inference.sh CLI, avoid running `curl | sh`, run login as a separate step, and do not install the optional related skills unless you have reviewed and pinned their exact versions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:306- Finding
Unpinned Third-Party Skill Installation Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl -fsSL https://cli.inference.sh | shpipes network-fetched content directly into the shell, which is a classic arbitrary code execution pattern. Even with the nearby note about checksum verification, the shown one-liner executes before any independent user verification, so compromise of the hosting endpoint, DNS/TLS path, or served script could lead to immediate code execution on the user's machine.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login # Research competitor landscape infsh app run tavily/search-assistant --input '{
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description includes a long list of broad trigger phrases such as market research, competitor comparison, and review analysis, which can cause the skill to activate for many generic business requests. Over-broad activation increases the chance that users are steered into using this skill's riskier instructions, including external installs and browser/search tooling, in contexts where it was not specifically intended.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The skill recommends invoking
npx skills add ...without pinning an exact package/version, which allows whatever package version is current at execution time to run code during installation. This creates a supply-chain risk: if the package is updated maliciously, compromised, or publishes a breaking change, users may execute unreviewed code simply by following the skill instructions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
This second
npx skills add ...command has the same issue: it executes a package resolution path that is not pinned to a specific trusted version. In a skill file, these copy-pasteable setup commands are especially risky because users may run them directly without reviewing what code will be fetched and executed.- Content
Static analysis
No suspicious patterns detected.