Landing Page Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:51 PM UTC
• Version: 0.1.5

Overview

This skill is mostly a landing-page design guide, but its setup instructions ask users to run mutable remote installers and unpinned skill installs that deserve review before use.

Review this before installing. The design advice itself is ordinary, but do not run the curl-to-sh installer or unpinned npx skill commands unless you trust the publisher and have verified the downloaded artifacts through a safer, pinned or checksum/signature-based process. Treat infsh prompts, generated assets, and search queries as data sent to external services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installation Script Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions retrieve a mutable shell script from an external server and immediately execute the response with `sh`. There is no opportunity to inspect the downloaded content, and the command does not authenticate the script using a pinned checksum or trusted digital signature before execution. Although the installation note claims that the script verifies the downloaded CLI binary, this does not establish the integrity of the installer itself. A compromised server, DNS or TLS trust failure, hosting-account takeover, or malicious future change to the installer could cause arbitrary commands to be returned and executed. The remote payload can therefore change after the Skill has been audited. Installing the CLI is related to the declared image-generation and research functionality, but direct execution of mutable remote shell content is not the minimum privilege or minimum-risk mechanism necessary to install it. ### Attack Path 1. A user follows the Quick Start instructions. 2. The shell requests the current content of `https://cli.inference.sh`. 3. The remote endpoint, or infrastructure controlling its response, returns attacker-controlled shell commands. 4. Because the response is piped directly to `sh`, those commands execute without inspection or pre-execution integrity verification. 5. The payload inherits the invoking user's permissions and access to their files, environment variables, network resources, and user-level configuration. 6. The command then invokes `infsh login`; if the installed binary was substituted or modified, the authentication workflow could expose newly entered credentials or tokens. There is no evidence in the reviewed file that the current ...[truncated 923 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | sh` installation pattern. - Pin the installation to a specific, immutable release rather than a mutable installer endpoint. - Download the release artifact to a local file without executing it. - Verify the artifact before installation using a pinned SHA-256 digest or, preferably, a signed release with a trusted public key obtained independently of the download location. - Display the verification and installation as separate commands so users can inspect the artifact and abort safely. - Use the documented manual installation process as the primary installation path. - Install the binary into a user-owned directory and avoid requiring `sudo` or other elevated permissions. - Keep installation and authentication as separate operations so users can verify which executable will receive their credentials. - Document the expected download host, destination path, checksum source, and verification procedure. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:238
• Finding: Unpinned Third-Party Skill Installation Through Dynamic Package Tooling<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 238-240 **Vulnerability Type**: Insecure dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@web-search npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis The Related Skills section instructs users to invoke package tooling and install third-party Skill content without pinning the package tool, dependency versions, immutable commit identifiers, or integrity hashes. The identifiers can resolve to content that changes after this Skill has been reviewed. In addition, `npx` may dynamically retrieve and execute the package providing the `skills` command when it is unavailable locally. This expands the trust boundary to the package registry, the package-tool namespace, the referenced Skill repository, maintainers, and their distribution infrastructure. These additions are optional related resources and are not required for the core landing-page guidance. Dynamically installing them therefore exceeds the minimum dependency scope necessary for the declared functionality. ### Attack Path 1. A user copies one of the Related Skills commands. 2. `npx` resolves the package implementing the `skills` command, potentially downloading a mutable package version. 3. The command resolves the requested third-party Skill from a mutable repository or package reference. 4. An attacker who compromises the relevant package, namespace, maintainer account, repository, or distribution infrastructure publishes malicious content. 5. The package tooling executes installation logic or installs attacker-controlled Skill instructions. 6. The malicious component gains the permissions available to the package process or influences later agent sessions when the installed Skill is loaded. No evidence establishes that the currently referenced packages or repositories are malicious. The find ...[truncated 824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the package providing the `skills` command to an audited, exact version. - Pin each related Skill to an immutable release version or commit hash. - Verify package integrity using registry integrity metadata, checksums, or signed release artifacts. - Document the canonical registry and repository for every dependency. - Review each related Skill and its installation hooks before recommending it. - Avoid automatic installation; present related Skills as optional references and require explicit user approval. - Use a lockfile or equivalent dependency manifest where supported. - Run installation in a restricted environment with only the filesystem and network access necessary for installation. - Regularly re-audit pinned dependencies before updating them. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a hero image
infsh app run falai/flux-dev-lora --input '{

• Confidence: 98% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` pipes remote content directly into a shell, which is a classic arbitrary code execution pattern. Even with claims about checksum verification, the bootstrap script itself is executed before independent verification by the user, so compromise of the host, CDN, DNS, TLS termination, or script publishing pipeline could lead to immediate code execution.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description lists triggers such as "landing page," "hero section," and especially "product page design," which are common design phrases and not narrowly scoped invocation conditions. The file does not provide constraints, exclusions, or negative examples clarifying when the skill should or should not activate.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Granting broad Bash access (`Bash(infsh *)`) is more permission than a content/design guidance skill should generally require. Even if partially scoped to `infsh`, it still authorizes command execution paths that can reach external services and potentially process sensitive user data or trigger unintended actions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a skill for landing page conversion optimization, layout rules, CTA psychology, and related design guidance. In the file, the skill also instructs users to install an external CLI, generate images with remote models, and research competitor pages through external search services, which goes beyond the narrow design-guidance description in the manifest.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill recommends invoking `npx skills add ...` without pinning an exact package/version, which allows whatever the current published package resolves to at execution time. If the upstream package, dependency chain, or package owner is compromised, users may execute unexpected code during install/use.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This `npx skills add ...` reference is unpinned, so it depends on the latest registry state rather than a reviewed artifact. That creates a supply-chain risk where a malicious or compromised release could run code in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: An unversioned `npx` install/use path is a real supply-chain exposure because package contents can change after the documentation is written. In a skill context, users may copy-paste the command directly, increasing the chance of executing unreviewed code.

Static analysis

No suspicious patterns detected.