Customer Persona

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

This persona skill is mostly coherent, but its quick start asks users to execute a mutable remote installer and then log in, which warrants careful review before installation.

Install only if you trust inference.sh's installer and account flow. Prefer a manual, version-pinned download with checksum or signature verification, run installation and login as separate steps, avoid elevated shells, and review any optional related skills before adding them because they are not pinned in this artifact.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Remote Installer Is Downloaded and Executed Without Prior Verification

Content

View full analysis

Remediation

View remediation

/' curl -fSLO 'https://dist.inference.sh/cli/releases//checksums.txt' sha256sum --check checksums.txt --ignore-missing install -m 0755 "$HOME/.local/bin/infsh" infsh --version infsh login ``` The actual release URL, artifact name, and trusted digest must be pinned to a reviewed version. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:247

Finding

Related Skills Are Installed From Unpinned Mutable References

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to pipe a remotely fetched script directly into sh, which is a classic arbitrary code execution pattern. Even with accompanying claims about checksum verification, the initial bootstrap script is still trusted and executed before independent review, so compromise of the host, transport, or script publisher could lead to full code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Research your target market
infsh app run tavily/search-assistant --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description's trigger list includes generic phrases such as "target audience," "user research," and "customer profile," which are broad enough to appear in ordinary product, marketing, or research discussions. The file does not provide exclusion conditions or narrower invocation constraints, increasing the chance of unintended activation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.