Image Upscaling

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:35 AM UTC
• Version: 0.1.5

Overview

The skill is for image upscaling, but its setup instructions ask users to run mutable remote installer and package-install commands that should be reviewed before use.

Review the installer and any related skills before running them. Prefer a pinned, manually downloaded, checksum-verified CLI install path, run login separately, and avoid the optional npx skill-add commands unless you trust and have reviewed those packages.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16
• Finding: Unverified Remote Installer Executed Directly in a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start command retrieves mutable content from `https://cli.inference.sh` and pipes it directly into `sh`. The downloaded installer is therefore executed before the user can inspect it, pin its version, or independently verify its integrity. The install note claims that the script detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum. However, verification performed by the remotely retrieved installer does not establish the integrity of the installer itself. A modified installer can bypass or replace its own verification logic and execute arbitrary commands. The effective payload can change after the Skill has been reviewed. Compromise of the remote server, publishing infrastructure, domain, or delivery path could turn the documented installation command into an arbitrary-code-execution channel. Executing a remote installer is not necessary for the Skill’s core image-upscaling functionality. At minimum, installation should be separated from execution and use a version-pinned, independently verified artifact. ### Attack Path 1. A user or agent follows the Quick Start instructions. 2. `curl` requests the current response hosted at `cli.inference.sh`. 3. The response is passed directly to `sh` without local review or independent integrity verification. 4. If the hosted script or its delivery infrastructure has been compromised, attacker-controlled shell commands execute with the invoking user’s privileges. 5. The malicious installer can access user-readable files and credentials, alter the user environment, download additional payloads, or establish persistence where existing permissions allow. ### Impact Assessment Successful expl ...[truncated 581 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Publish versioned CLI artifacts and require users to select a specific immutable release. 3. Download the artifact to disk without executing it automatically. 4. Publish cryptographic checksums or signatures through an independently trusted channel. 5. Require verification before installation, for example: - Verify a SHA-256 digest against a release-pinned value. - Prefer a signed artifact and validate the signature against a documented public key. 6. Keep installation and authentication as separate commands so installation success does not automatically trigger credential-related operations. 7. Prefer a reputable package manager that supports version pinning, integrity metadata, and package provenance. 8. Document the destination path, files created, network endpoints contacted, and permissions required by the CLI. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62
• Finding: Mutable Third-Party Skill Dependencies Installed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-71` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash # Full platform skill (all 150+ apps) npx skills add inference-sh/skills@inference-sh # Image generation (generate then upscale) npx skills add inference-sh/skills@ai-image-generation # FLUX models npx skills add inference-sh/skills@flux-image # Background removal npx skills add inference-sh/skills@background-removal ``` ### Technical Analysis The Related Skills section instructs users to invoke `npx` and add third-party Skill references without pinning them to immutable package versions, release digests, or repository commit hashes. Consequently, the content installed by these commands can change after this project has been audited. This creates a supply-chain trust boundary: security depends on the integrity of the `skills` package resolution process, the referenced upstream repository or registry, its maintainers, and its transitive dependencies. The project provides no integrity value or provenance check that would allow users to confirm that they received the same content that was reviewed. These dependencies are optional and are not required for the declared image-upscaling workflow. Encouraging their direct installation unnecessarily expands the trusted code and instruction surface. ### Attack Path 1. An attacker compromises an upstream maintainer account, package, repository, publication process, or dependency. 2. A malicious version is published under one of the mutable references used in the documentation. 3. A user follows the Related Skills instructions and executes the relevant `npx skills add` command. 4. `npx` resolves remote package content, and the command installs Skill content that was not part of this audit. 5. The added content may introduce malicious agent instructions or executable behavior, depending on the package and installer behavior. ### Impact Asses ...[truncated 617 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` utility and each referenced Skill to verified, immutable versions or repository commit hashes. 2. Where supported, use lockfiles and integrity hashes to ensure deterministic resolution. 3. Verify package provenance, publisher identity, signatures, and checksums before installation. 4. Review the complete contents and installation behavior of each related Skill before recommending it. 5. Avoid automatic execution of package installation hooks where possible. 6. Clearly mark these dependencies as optional and explain that they are not required for image upscaling. 7. Prefer a curated, security-reviewed dependency source rather than mutable upstream references. 8. Re-audit dependencies whenever pinned versions are intentionally updated. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

infsh app run infsh/real-esrgan --input '{"image_url": "https://your-image.jpg"}'
```

• Confidence: 97% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` pipes a remotely fetched script directly into a shell, enabling arbitrary code execution if the server, CDN, DNS, TLS trust chain, or publishing pipeline is compromised. Although the surrounding text claims checksum verification and no elevated permissions, those assurances are themselves untrusted documentation and do not remove the core risk of executing a mutable remote script.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases such as `enhance image`, `higher resolution`, and `image enhancement`, which are common user intents and can cause the skill to activate unexpectedly. Over-broad invocation increases the chance that users are steered into running the skill's shell-based workflows, including remote install commands, in contexts where they did not explicitly request this tool.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill recommends executing `npx skills add ...` without pinning an exact package version, which allows retrieval of whatever version is current at execution time. If the upstream package is compromised or a breaking/malicious release is published, users may install and run unreviewed code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This `npx skills add ...` command is unpinned, so it resolves to the latest published package at runtime rather than a reviewed version. That creates a software supply-chain risk: future package compromise or namespace abuse could lead to arbitrary code execution on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The example uses `npx skills` without version pinning, making execution dependent on the current registry state. In documentation intended for end users, this is dangerous because it normalizes running mutable remote package code directly from the package registry.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: An unpinned `npx skills add ...` command introduces a supply-chain risk because users cannot know in advance which package contents will be executed. In the context of a skill file that may be copied verbatim, this can directly expose users to malicious package updates.

Static analysis

No suspicious patterns detected.