Email Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

The skill is mostly email-design guidance, but its primary setup path asks users to execute a remote installer in their shell and recommends unpinned external skill installs.

Review the installer and related skill sources before running these commands. Prefer a separately downloaded, inspected, version-pinned, and checksum-verified installer, and avoid running the `npx skills add` examples unless you trust the current upstream packages and skills.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Remote Installer Is Downloaded and Executed Without Prior Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions pipe a mutable HTTPS response directly into `sh`. The downloaded installer is therefore executed with the invoking user's privileges before the user can inspect it or independently verify its integrity. Although the document claims that the installer verifies the SHA-256 checksum of a subsequently downloaded binary, that process does not establish the integrity of the installer itself. A compromised installer could bypass or falsify its own verification procedure. The repository does not pin an installer version, provide an expected installer digest, verify a digital signature, or include the installer source for review. This installation mechanism is not required for the Skill's core email-design guidance. It is needed only to use an optional external image-generation service and consequently exceeds the minimum access needed for the Skill's principal documentation functionality. ### Attack Path 1. A user copies the Quick Start command into a shell. 2. `curl` retrieves the current response from `https://cli.inference.sh`. 3. A compromise of the hosting service, CDN, DNS path, deployment credentials, or installer publication process changes the remote response. 4. The pipe passes the response directly to `sh`, without saving it for inspection or verifying it against a repository-pinned digest or signature. 5. The malicious response executes with all privileges available to the invoking user. 6. The payload can access user-readable data, alter user-writable files, install additional components, or capture credentials subsequently entered during `infsh login`. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account that ru ...[truncated 529 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` pipeline and make the external image-generation tooling explicitly optional. 2. Pin the installer and CLI to an immutable, documented version. 3. Download the artifact without executing it: ```bash curl -fL -o infsh-installer.sh "https://example.invalid/infsh-installer-VERSION.sh" ``` 4. Publish the expected SHA-256 digest in the reviewed Skill repository rather than obtaining both the artifact and its trust value from the same mutable endpoint. 5. Require users to verify the downloaded artifact before execution: ```bash echo "EXPECTED_SHA256 infsh-installer.sh" | sha256sum --check - ``` 6. Prefer a cryptographic signature verified against a public key distributed through a separate trusted channel. 7. Allow users to inspect the saved installer before invoking it explicitly. 8. Prefer a recognized package manager with version pinning, integrity metadata, and reproducible release artifacts. 9. Document the files, network endpoints, credentials, and permissions used by the CLI so users can make an informed trust decision. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235
• Finding: Unpinned npx Package and Remote Skill Dependencies Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:235-237` **Vulnerability Type**: Insecure third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@landing-page-design npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis The recommended commands do not pin the `skills` package invoked through `npx` to a reviewed version. Depending on the local environment and package resolution behavior, `npx` may download and execute the currently published package. The three referenced Skills are likewise identified by mutable names rather than exact versions, immutable commit hashes, or verified content digests. The project contains no lockfile, integrity metadata, vendored source, signatures, or reviewed snapshots for these dependencies. Consequently, the code and instructions obtained when users run these commands can differ from what existed when this Skill was audited. This creates a multi-stage supply-chain trust problem: the package used to perform installation is mutable, and the Skills it retrieves are also mutable. Compromise of a package registry account, upstream repository, maintainer credentials, or dependency publication pipeline could introduce executable code or hostile Skill instructions. ### Attack Path 1. An attacker compromises the package, an upstream Skill source, or its publication credentials. 2. The attacker publishes a malicious version under one of the mutable package or Skill identifiers. 3. A user follows the Related Skills instructions. 4. `npx` resolves and may execute the unpinned `skills` package. 5. The command retrieves an unpinned remote Skill whose content can differ from the previously reviewed version. 6. Malicious package code can execute with the user's privileges, or malicious Skill instructions can influence later agent behavior when loaded. ### Impact Assessment If execut ...[truncated 681 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` package to an exact reviewed version instead of allowing `npx` to resolve the current release. 2. Pin every referenced Skill to an immutable release version or commit hash. 3. Record and verify cryptographic hashes for retrieved Skill contents. 4. Add an appropriate lockfile and preserve registry integrity metadata where supported. 5. Review downloaded Skill text and scripts before installation or activation. 6. Prefer vendored, audited copies when reproducibility and trust are important. 7. Use package-manager modes that refuse unexpected dependency updates and lifecycle-script execution where feasible. 8. Document the expected publisher, repository, version, and digest for each recommended dependency. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate email header banner
infsh app run infsh/html-to-image --input '{

• Confidence: 99% confidence
• Finding: This is a concrete external-script execution pattern: `curl -fsSL https://cli.inference.sh | sh`. It creates an immediate remote code execution path in the user's shell session, and the skill context makes it more dangerous because it is presented as the quick-start installation command, increasing the chance that users will run it without scrutiny.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description lists generic triggers such as "email template," "email marketing," and "email campaign" without clear activation boundaries or exclusion conditions. These phrases are broad enough to overlap with many general marketing-help requests, increasing the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill instructs users to pipe a remote script directly into `sh`, which executes downloaded code without a prior inspection step. Even though the note claims checksum verification, users must trust the remote server and bootstrap script entirely; if that endpoint, CDN path, or TLS trust chain is compromised, arbitrary code execution on the user's machine can result.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.