Email Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

The skill is mostly email-design guidance, but its primary setup path asks users to execute a remote installer in their shell and recommends unpinned external skill installs.

Review the installer and related skill sources before running these commands. Prefer a separately downloaded, inspected, version-pinned, and checksum-verified installer, and avoid running the `npx skills add` examples unless you trust the current upstream packages and skills.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Remote Installer Is Downloaded and Executed Without Prior Verification

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Unpinned npx Package and Remote Skill Dependencies Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is a concrete external-script execution pattern: curl -fsSL https://cli.inference.sh | sh. It creates an immediate remote code execution path in the user's shell session, and the skill context makes it more dangerous because it is presented as the quick-start installation command, increasing the chance that users will run it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate email header banner
infsh app run infsh/html-to-image --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description lists generic triggers such as "email template," "email marketing," and "email campaign" without clear activation boundaries or exclusion conditions. These phrases are broad enough to overlap with many general marketing-help requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to pipe a remote script directly into sh, which executes downloaded code without a prior inspection step. Even though the note claims checksum verification, users must trust the remote server and bootstrap script entirely; if that endpoint, CDN path, or TLS trust chain is compromised, arbitrary code execution on the user's machine can result.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.