Flux Image

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:35 AM UTC
• Version: 0.1.5

Overview

This FLUX image skill is mostly coherent, but it asks users to run mutable remote installer and package commands that can execute code outside the reviewed skill.

Review this skill before installing. The core image-generation behavior is understandable, but do not copy the curl-to-shell or unpinned npx commands unless you trust the publisher and have independently reviewed or pinned what will run. Avoid submitting secrets, private image URLs, or sensitive media through the remote inference service.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Unverified Remote Installer Executed Directly Through a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The Quick Start command streams the current response from https://cli.inference.sh directly into sh. The user cannot inspect or authenticate the installer before execution, and the effective payload can change after this Skill has been reviewed.

HTTPS protects the connection in transit but does not guarantee that future content served by the domain is trustworthy. A compromise of the domain, DNS, TLS endpoint, web server, deployment pipeline, or hosting account could therefore turn the documented installation command into arbitrary code execution.

The installation note claims that the script only detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum. However, the Skill does not independently constrain or verify the installer script before it runs. Binary checksum verification performed by an already executing remote script does not establish the integrity of that script. Installation is relevant to the declared image-generation functionality, but executing a mutable and unreviewed shell program exceeds the minimum safe trust required to install the CLI.

Attack Path

1. An attacker compromises or gains control over the content returned by cli.inference.sh, or otherwise compromises its delivery infrastructure.
2. The attacker modifies the installer response to include arbitrary shell commands while optionally preserving expected installation behavior.
3. A user or agent follows the Quick Start instruction in SKILL.md.
4. curl streams the attacker-controlled response directly into sh.
5. The malicious commands execute immediately with the invoking user's permissions, before the user can inspect the payloa ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pipeline.
2. Pin the CLI to a specific reviewed version rather than installing an implicitly mutable latest release.
3. Download the platform-specific artifact to a local file without executing it.
4. Verify the artifact against a checksum embedded in the reviewed Skill or, preferably, a release signature validated against a pinned trusted public key.
5. Do not rely solely on checksums fetched from the same mutable delivery infrastructure as the artifact.
6. Execute or install the artifact only after verification succeeds, and document the intended destination and required permissions.
7. Provide manual, inspectable installation commands as the default procedure.
8. Keep authentication (infsh login) separate from installation so that credentials are not created immediately after untrusted installation logic has run.
9. Avoid elevated privileges and ensure the CLI is installed only within a user-controlled directory unless system-wide installation is explicitly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command curl -fsSL https://cli.inference.sh | sh downloads and immediately executes a remote script, which is a classic high-risk pattern. Even if the vendor currently publishes checksums, piping network content directly to a shell bypasses meaningful review and makes users vulnerable to server compromise, TLS interception edge cases, or malicious changes to the install script.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

infsh app run falai/flux-dev-lora --input '{"prompt": "a futuristic city at night"}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad terms like flux, flux image, flux model, and black forest labs, which may match loosely related user requests and cause unintended skill activation. In combination with broad tool permissions, accidental invocation could lead to external service calls or execution of commands the user did not intend.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The allowed tool pattern Bash(infsh *) permits any infsh command, while the skill is described as a narrow FLUX image-generation helper. This overbroad authorization increases the blast radius if the skill is invoked unexpectedly or if future instructions steer the agent toward unrelated infsh capabilities, including broader app execution and account-affecting operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples send user prompts and image URLs to an external inference service, but the skill does not prominently warn that user-supplied content will leave the local environment. This can expose sensitive prompts, proprietary image URLs, or private media if users assume the skill operates locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The skill recommends installing and executing npx skills packages directly from a remote registry without pinning to a specific version or immutable source. That creates a supply-chain risk: a later malicious or compromised package update could be fetched and executed automatically when a user follows the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

This npx skills add example invokes a remotely resolved package without version pinning, so the exact code executed can change over time. If the upstream package or dependency chain is compromised, users may run unintended code in their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx skills without pinning the package version introduces non-deterministic execution of third-party code from the package registry. In a skill document, this is especially risky because users may copy-paste the command and trust it as endorsed by the skill author.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description scopes the skill to FLUX models and FLUX-specific capabilities, but the file also instructs use of non-FLUX apps such as falai/reve, falai/topaz-image-upscaler, and infsh app list for broader platform discovery. This expands the documented behavior beyond the stated FLUX-focused purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.