Logo Design Guide

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

The logo skill is mostly coherent, but its quick start asks users to run a mutable remote installer directly in the shell, so it needs review before installation.

Before installing, avoid the one-line `curl | sh` path unless you trust the publisher and delivery channel. Prefer downloading the installer or binary separately, verifying checksums or signatures from an independent source, and treating `infsh login` as a separate authentication step. Review any optional related skills before adding them, especially because the documented commands are unpinned.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Remote Installer Downloaded and Executed Without Independent Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The Quick Start instructions pipe content retrieved from a mutable external URL directly into a shell. The user cannot inspect the downloaded installer before execution, and the command does not pin an installer version, validate the installer against a trusted cryptographic signature, or verify a locally downloaded file before running it.

The documentation states that the remote installer verifies the checksum of the CLI binary it downloads. This does not establish the integrity of the installer itself. If the installer endpoint or its deployment infrastructure is compromised, the returned script can change its own verification behavior, select a malicious binary, or execute unrelated commands before any binary verification occurs.

Although installing a CLI supports the Skill's declared functionality, immediate execution of mutable remote code is not the minimum-risk installation mechanism. The command runs the installer with all permissions available to the invoking user and then starts an authentication flow.

Attack Path

1. An attacker compromises the installer endpoint, its hosting infrastructure, or another relevant upstream delivery component.
2. The attacker changes the content returned by https://cli.inference.sh.
3. A user or agent follows the documented Quick Start command.
4. curl retrieves the attacker-controlled script.
5. The pipe sends the response directly to sh, which executes it without inspection or independent integrity validation.
6. The script performs arbitrary operations using the invoking user's permissions.
7. The attacker may access user-readable data, modify user-owned files, steal available credentials, install additi ...[truncated 787 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern.
2. Pin the CLI to a specific reviewed release rather than retrieving an implicitly current version.
3. Download the release artifact to a local file without executing it.
4. Verify the artifact using a cryptographic signature or a pinned SHA-256 digest obtained through an independent trusted channel.
5. Abort installation if verification fails.
6. Execute or install the artifact only after successful verification and, where practical, explicit user approval.
7. Keep infsh login separate from installation so authentication is a distinct, user-confirmed action.
8. Publish reproducible release metadata and signed checksums over a separately secured channel.
9. Avoid recommending elevated privileges; install into a user-controlled location with only the permissions required by the CLI.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:183

Finding

Unpinned Third-Party Skill Installation Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:183-184
Vulnerability Type: Insecure dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx skills add inference-sh/skills@ai-image-generation
npx skills add inference-sh/skills@prompt-engineering

Technical Analysis

These optional instructions invoke an unpinned npx command and install Skill dependencies using mutable identifiers rather than exact reviewed versions or immutable commit references. Depending on the local environment and npx behavior, the skills package may be fetched dynamically and executed. The referenced Skill content can also change after this project has been reviewed.

This creates a supply-chain boundary in which both the installer tooling and installed Skill content may differ between invocations. No version constraint, commit hash, integrity value, signature verification, or review requirement is documented.

Attack Path

1. An attacker compromises the relevant npm package, package-publishing account, Skill repository, distribution infrastructure, or mutable dependency reference.
2. The attacker publishes or substitutes a malicious package or Skill revision.
3. A user follows one of the documented npx skills add commands.
4. npx retrieves and runs the available CLI package, and the CLI retrieves the mutable Skill dependency.
5. Malicious installation behavior or Skill instructions execute or become available in the user's agent environment.
6. The resulting impact depends on the permissions and tools granted to the fetched package or Skill.

Impact Assessment

A compromised npx package can potentially execute code with the invoking user's permissions. A compromised installed Skill can influence subsequent agent behavior and access any tools authorized for that Skill. Potential exposure includes user-owned files, environment data, credentials available to the process, and agent actions permitted b ...[truncated 320 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an exact reviewed package version rather than relying on an implicitly selected npx version.
2. Pin each related Skill to an immutable release or commit hash.
3. Use package-lock or equivalent integrity metadata where supported.
4. Verify package provenance, signatures, and expected integrity hashes before execution.
5. Instruct users to inspect the requested Skill and its permissions before installation.
6. Prefer a preinstalled, organization-approved CLI over dynamically retrieving executable tooling through npx.
7. Re-audit dependency revisions before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl -fsSL https://cli.inference.sh | sh is direct external script execution, a well-known high-risk pattern because any compromise of the host, CDN, DNS, TLS termination, or served artifact can lead to arbitrary code execution on the user's machine. The skill context makes this more dangerous because it is framed as the primary quick-start path, increasing the likelihood that users will copy-paste it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a logo concept
infsh app run falai/flux-dev-lora --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This is a manifest file section in SKILL.md, so vague-trigger review applies. The listed triggers include generic phrases like "create logo," "logo design," and "icon design," which are broad enough to match everyday requests without clearly constraining when this specific skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start command tells users to pipe a remotely fetched script directly into sh, which executes downloaded code immediately without an opportunity for local review. Even though the note claims checksum verification and benign behavior, users must trust the remote endpoint and transport at execution time, making this a classic unsafe install pattern with meaningful compromise risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill recommends npx skills add inference-sh/skills@ai-image-generation without pinning a specific version or commit, so future executions may fetch changed code or content unexpectedly. While this is presented as a convenience command rather than hidden execution, unpinned remote package resolution increases supply-chain risk if the upstream package is modified or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The second npx skills add inference-sh/skills@prompt-engineering example also references remotely resolved package content without a pinned version. That means users may install different code over time, creating a reproducibility and supply-chain integrity problem if the dependency changes or is hijacked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.