Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent LLM-access purpose, but its setup instructions ask users to run mutable remote installation and unpinned package commands with insufficient safety controls.
Review carefully before installing. Prefer a manually downloaded, version-pinned, checksum- or signature-verified CLI release; avoid running the pipe-to-shell command as shown. Do not send secrets, regulated data, private source code, or sensitive prompts through this skill unless you trust inference.sh, OpenRouter, and the selected model provider. Treat the related npx skill-install commands as mutable supply-chain actions unless pinned and verified.
SKILL.md:16Mutable Remote Installation Script Executed Directly by Shell
SKILL.md:110Unpinned Third-Party Package and Skill Installation Commands
curl -fsSL https://cli.inference.sh | sh pipes network-fetched content directly into a shell, creating a classic remote code execution and supply-chain risk. Even though the markdown claims checksum verification and no elevated permissions, users are still encouraged to execute an unaudited bootstrap script before they can independently verify what it does.
curl -fsSL https://cli.inference.sh | sh && infsh login
# Call Claude Sonnet
infsh app run openrouter/claude-sonnet-45 --input '{"prompt": "Explain quantum computing"}'
The trigger list includes broad terms such as language model, chat api, and openai alternative, which are generic enough to cause the skill to activate in many unrelated contexts. Over-broad invocation increases the chance that users are steered toward remote model access and installation steps unexpectedly, expanding exposure to external network use and command execution guidance.
The Quick Start instructs users to install a remote CLI and log in, then send prompts to external model APIs, but it does not clearly warn that prompts, metadata, and credentials may be transmitted to third-party services. In a skill intended for AI assistants and agents, this omission is significant because users may paste sensitive data into prompts without understanding the external data flow.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
No suspicious patterns detected.