ClawHub
Back to skill

Security audit

Content Repurposing

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a content-repurposing guide, but it asks users to run a mutable remote installer and includes live social-posting commands without clear consent safeguards.

Install only if you are comfortable trusting inference.sh's live installer and connected apps. Prefer a manually downloaded, pinned, checksum-verified CLI release, review any related skills before installing them, and do not run posting commands unless you have reviewed the exact content and intend to publish it from the connected account.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Mutable Remote Installer Executed Directly by a Shell

Content
View full analysis
Remediation
View remediation
/infsh.example.tar.gz echo ' infsh.example.tar.gz' | sha256sum -c - # Extract and install only after successful verification. infsh login ``` The actual release URL, filename, version, and digest must be obtained from a trusted, authenticated release channel and committed or otherwise pinned independently of the downloaded payload. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:244
Finding

Unpinned Third-Party Skill Installation Through npx

Content
View full analysis
Remediation
View remediation
\ skills add inference-sh/skills@ ``` The placeholders must be replaced with genuine reviewed versions or immutable commit identifiers; they must not be replaced with mutable tags such as `latest`. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a classic code-execution and supply-chain risk. Even with a note claiming checksum verification, users are still trusting network-delivered script content at execution time, and compromise of the hosting path could lead to arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a quote card from a blog pull-quote
infsh app run falai/flux-dev-lora --input '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description lists triggers such as "adapt content" and "reformat content," which are generic phrases that can appear in ordinary user requests outside this specific skill. The file does not provide exclusion conditions or negative examples to narrow when the skill should activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as content repurposing, but the example goes beyond transformation and performs direct publishing to X. Expanding from content generation into outbound actions increases the risk of unintended external side effects, especially if invoked by an agent without explicit confirmation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Direct social media posting is not necessary to fulfill the stated purpose of reformatting content into other formats. Including posting capability creates unnecessary privilege and can cause accidental publication, reputational harm, or unauthorized use of connected social accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example posts content to X without any warning that it performs an external publishing action. Users or calling agents may interpret it as a harmless repurposing example, leading to accidental public posting from authenticated accounts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.