Security audit

Javascript Sdk

Security checks for vulnerabilities and agentic risk

Overview

This is mostly SDK documentation, but it gives broad development command authority and includes copyable examples that could expose keys, upload files publicly, run unsafe code, or deploy open proxies.

Install only if you specifically want inference.sh JavaScript SDK guidance and are comfortable reviewing generated code carefully. Require approval before npm, npx, yarn, pnpm, or node commands; do not copy eval-based tool handlers; keep API keys server-only; add authentication, authorization, rate limits, and allowlists to proxy endpoints; avoid public file uploads unless intentional; and treat file uploads, webhooks, browser automation, and saved chat history as sensitive data-transfer or retention events.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: references/tool-builder.md:235
Finding: Model-Controlled Tool Arguments Are Executed Through eval()
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:402
Finding: Credential-Backed Inference Proxies Are Exposed Without Mandatory Access Control
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/server-proxy.md:389
Finding: Public Browser Environment Variable Exposes the Inference API Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/files.md:5
Finding: Automatic Upload and Public File Examples Can Disclose Sensitive Local Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/agent-patterns.md:153
Finding: Conversation History Is Persisted in Plaintext and Replayed Without Integrity Validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Executable SDK and Skill Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence

Findings (26)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/tool-builder.md (reported line 159)May include surrounding context.
de', 'my-org/coder@latest') .describe('Write code to solve a problem') .param('task', string('Coding task description')) .param('language', string('Programming language')) .build();

text
### Webhook Tools Tools that call external HTTP endpoints: ```typescript import { webhookTool, string } from '@inferencesh/sdk'; // Slack notification const slack = webhookTool('notify_slack', 'https://hooks.slack.com/services/...') .describe('Send a message to Slack') .param('channel', string('Channel name')) .param('message', string('Message text')) .build(); // Webhook with secret const github = webhookTool('create_issue', 'https://api.github.com/repos/org/repo/issues') .describe('Create a GitHub issue') .secret('GITHUB_TOKEN') // Uses stored secret .param('title', string('Issue title')) .param('body', string('Issue description')) .build();

Tool Builder Methods

Common Methods

Method Description
.describe(text) Set tool

Method	Description
`.describe(text)`	Set tool

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
// Multi-turn conversation const response2 = await agent.sendMessage('Tell me more'); // Reset conversation agent.reset(); // Get chat history

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 508)May include surrounding context.
md
- [TypeScript](references/typescript.md) - Type definitions and type-safe patterns

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/tool-builder.md (reported line 423)May include surrounding context.
md
export async function POST(req: Request) { const { data } = await req.json(); // Access secrets safely on server const result = await fetch(process.env.EXTERNAL_API_URL, { headers: { Authorization: `Bearer ${process.env.API_SECRET}` }, body: JSON.stringify(data)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad terms like npm install, node.js api, react ai, and frontend sdk, which are likely to match many ordinary development requests unrelated to this specific skill. Over-broad activation increases the chance that the skill is injected into unrelated contexts, expanding attack surface and causing unintended tool availability or instruction influence.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill recommends running npx skills add ... without pinning an exact package version or commit. npx resolves and executes the latest matching package at runtime, which creates a supply-chain risk if the upstream package is compromised or changes unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This example invokes npx skills without a pinned version, allowing execution of whatever package version is current at install time. That exposes users to package hijacking, malicious updates, or non-reproducible behavior in environments that trust the documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx skills without version pinning creates a classic documentation-driven supply-chain exposure because readers may execute an unreviewed latest release. In a skill file that explicitly allows Bash execution of npm/npx commands, this is more operationally dangerous because an agent could directly run the example.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This unpinned npx skills reference can lead users or agents to execute an unexpectedly changed or malicious package version. The risk is amplified by the skill’s permitted Bash tooling, which lowers the barrier from documentation to execution.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/agent-patterns.md (reported line 149)May include surrounding context.
Conversation Memory Pattern

Maintain context across sessions:

typescript
import { inference } from '@inferencesh/sdk';

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes example code that saves and reloads full chat history to a local file via writeFileSync and readFileSync, but the surrounding documentation does not warn that user conversation data will be persisted on disk. Because markdown files should disclose behaviors affecting user data or privacy, this omission is a relevant safety concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation demonstrates automatic uploads of local paths and an option for public: true without any caution about sensitive file disclosure, accidental exfiltration, or public accessibility. In an SDK file-handling guide, this can lead developers to copy insecure patterns directly into production workflows, especially because local path auto-upload obscures the security boundary between local files and remote service submission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The chat and image analysis examples transmit user prompts and image URIs to a remote AI service without warning users that their content will be shared off-device/off-app. Because this is SDK documentation for frontend React apps, developers may embed these patterns unchanged, creating silent data disclosure of potentially sensitive text or media references.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file upload component example sends a user-selected file to a remote service via client.uploadFile(file) but does not include any explicit UX warning, consent step, or disclosure that the file leaves the user's device. In a React integration reference, developers often copy examples directly, so this omission can lead to unintended transmission of sensitive files and privacy/compliance issues in downstream apps.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document correctly advises never exposing API keys in browser code, but later includes a development example that uses NEXT_PUBLIC_INFERENCE_API_KEY in client-side configuration. This contradiction can lead developers to treat secret-bearing client configuration as acceptable, resulting in API key exposure, unauthorized use, and billing abuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The early example emphasizes 'Frontend code - no API key!' but a later example demonstrates initializing the frontend SDK with a NEXT_PUBLIC_ API key. In security-sensitive documentation, inconsistent guidance is dangerous because readers often copy the shortest working example, normalizing exposure of credentials in browser-delivered code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The local testing example shows direct use of process.env.NEXT_PUBLIC_INFERENCE_API_KEY in code intended for frontend execution. In frameworks like Next.js, NEXT_PUBLIC_* variables are embedded into browser bundles, so this teaches a pattern that leaks the key to any user, enabling theft, replay, and uncontrolled consumption of the API account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file includes a browser-automation workflow that opens a URL, clicks elements, types an email address, and captures a screenshot, but it does not warn that the skill may send user inputs to third-party websites or perform actions on their behalf. For markdown files, behaviors that can affect user data, privacy, or system integrity should be accompanied by an explicit warning.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/tool-builder.md (reported line 166)May include surrounding context.
md
.build(); // Webhook with secret const github = webhookTool('create_issue', 'https://api.github.com/repos/org/repo/issues') .describe('Create a GitHub issue') .secret('GITHUB_TOKEN') // Uses stored secret .param('title', string('Issue title'))

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation shows eval(call.args.expression) in a tool handler, where call.args is model-influenced input. This normalizes arbitrary code execution as a calculator pattern, allowing an attacker or prompt-injected model output to execute JavaScript in the host process rather than merely evaluate math.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The complete example repeats eval in production-style sample code and frames it as an acceptable implementation for a calculator tool. Because tool arguments may be attacker-controlled or influenced by an LLM, this can lead to arbitrary JavaScript execution, data access, and system compromise in applications that copy the example.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example sets public: true for file uploads without any warning that uploaded content may become publicly accessible. In SDK reference documentation, readers often copy examples verbatim, so this can lead to unintentional exposure of sensitive files, tokens, internal documents, or user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The download examples fetch remote content and write it to disk or trigger browser downloads without noting that the content is untrusted and may overwrite local files or deliver unsafe files to users. While the snippets are simple, documentation that omits trust and path-safety guidance can normalize unsafe handling of remote outputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The Stateful Conversations section demonstrates retaining chat context for 30 minutes, but it does not disclose that user-provided conversation content remains available within the session during that period. In markdown guidance, persistence of user data across requests should be called out when it could affect privacy expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown reference introduces webhook tools that send messages and issue content to external services such as Slack and GitHub, including use of a stored secret, but the surrounding documentation does not explicitly warn that tool inputs will be transmitted to third-party endpoints. Because this is a documentation file, SQP-2 applies when descriptions omit privacy or data-transfer warnings for behaviors that could affect user data.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/server-proxy.md:137

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Tool Builder Methods

Common Methods

Memory Manipulation

Ae1

Credential Access

Vague Triggers

Rp1

Rp1

Rp1

Rp1

Session Persistence

Conversation Memory Pattern

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

External Transmission

Intent-Code Divergence

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis

File appears to expose a hardcoded API secret or token.