Logo Design Guide

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

The logo skill is mostly coherent, but its quick start asks users to run a mutable remote installer directly in the shell, so it needs review before installation.

Before installing, avoid the one-line `curl | sh` path unless you trust the publisher and delivery channel. Prefer downloading the installer or binary separately, verifying checksums or signatures from an independent source, and treating `infsh login` as a separate authentication step. Review any optional related skills before adding them, especially because the documented commands are unpinned.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Remote Installer Downloaded and Executed Without Independent Verification## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions pipe content retrieved from a mutable external URL directly into a shell. The user cannot inspect the downloaded installer before execution, and the command does not pin an installer version, validate the installer against a trusted cryptographic signature, or verify a locally downloaded file before running it. The documentation states that the remote installer verifies the checksum of the CLI binary it downloads. This does not establish the integrity of the installer itself. If the installer endpoint or its deployment infrastructure is compromised, the returned script can change its own verification behavior, select a malicious binary, or execute unrelated commands before any binary verification occurs. Although installing a CLI supports the Skill's declared functionality, immediate execution of mutable remote code is not the minimum-risk installation mechanism. The command runs the installer with all permissions available to the invoking user and then starts an authentication flow. ### Attack Path 1. An attacker compromises the installer endpoint, its hosting infrastructure, or another relevant upstream delivery component. 2. The attacker changes the content returned by `https://cli.inference.sh`. 3. A user or agent follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled script. 5. The pipe sends the response directly to `sh`, which executes it without inspection or independent integrity validation. 6. The script performs arbitrary operations using the invoking user's permissions. 7. The attacker may access user-readable data, modify user-owned files, steal available credentials, install additi ...[truncated 787 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Pin the CLI to a specific reviewed release rather than retrieving an implicitly current version. 3. Download the release artifact to a local file without executing it. 4. Verify the artifact using a cryptographic signature or a pinned SHA-256 digest obtained through an independent trusted channel. 5. Abort installation if verification fails. 6. Execute or install the artifact only after successful verification and, where practical, explicit user approval. 7. Keep `infsh login` separate from installation so authentication is a distinct, user-confirmed action. 8. Publish reproducible release metadata and signed checksums over a separately secured channel. 9. Avoid recommending elevated privileges; install into a user-controlled location with only the permissions required by the CLI.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:183
• Finding: Unpinned Third-Party Skill Installation Through npx## Vulnerability Details **File Location**: `SKILL.md:183-184` **Vulnerability Type**: Insecure dependencies **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis These optional instructions invoke an unpinned `npx` command and install Skill dependencies using mutable identifiers rather than exact reviewed versions or immutable commit references. Depending on the local environment and `npx` behavior, the `skills` package may be fetched dynamically and executed. The referenced Skill content can also change after this project has been reviewed. This creates a supply-chain boundary in which both the installer tooling and installed Skill content may differ between invocations. No version constraint, commit hash, integrity value, signature verification, or review requirement is documented. ### Attack Path 1. An attacker compromises the relevant npm package, package-publishing account, Skill repository, distribution infrastructure, or mutable dependency reference. 2. The attacker publishes or substitutes a malicious package or Skill revision. 3. A user follows one of the documented `npx skills add` commands. 4. `npx` retrieves and runs the available CLI package, and the CLI retrieves the mutable Skill dependency. 5. Malicious installation behavior or Skill instructions execute or become available in the user's agent environment. 6. The resulting impact depends on the permissions and tools granted to the fetched package or Skill. ### Impact Assessment A compromised `npx` package can potentially execute code with the invoking user's permissions. A compromised installed Skill can influence subsequent agent behavior and access any tools authorized for that Skill. Potential exposure includes user-owned files, environment data, credentials available to the process, and agent actions permitted b ...[truncated 320 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` CLI to an exact reviewed package version rather than relying on an implicitly selected `npx` version. 2. Pin each related Skill to an immutable release or commit hash. 3. Use package-lock or equivalent integrity metadata where supported. 4. Verify package provenance, signatures, and expected integrity hashes before execution. 5. Instruct users to inspect the requested Skill and its permissions before installation. 6. Prefer a preinstalled, organization-approved CLI over dynamically retrieving executable tooling through `npx`. 7. Re-audit dependency revisions before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a logo concept
infsh app run falai/flux-dev-lora --input '{

• Confidence: 97% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` is direct external script execution, a well-known high-risk pattern because any compromise of the host, CDN, DNS, TLS termination, or served artifact can lead to arbitrary code execution on the user's machine. The skill context makes this more dangerous because it is framed as the primary quick-start path, increasing the likelihood that users will copy-paste it without scrutiny.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This is a manifest file section in SKILL.md, so vague-trigger review applies. The listed triggers include generic phrases like "create logo," "logo design," and "icon design," which are broad enough to match everyday requests without clearly constraining when this specific skill should or should not activate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The quick-start command tells users to pipe a remotely fetched script directly into `sh`, which executes downloaded code immediately without an opportunity for local review. Even though the note claims checksum verification and benign behavior, users must trust the remote endpoint and transport at execution time, making this a classic unsafe install pattern with meaningful compromise risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill recommends `npx skills add inference-sh/skills@ai-image-generation` without pinning a specific version or commit, so future executions may fetch changed code or content unexpectedly. While this is presented as a convenience command rather than hidden execution, unpinned remote package resolution increases supply-chain risk if the upstream package is modified or compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The second `npx skills add inference-sh/skills@prompt-engineering` example also references remotely resolved package content without a pinned version. That means users may install different code over time, creating a reproducibility and supply-chain integrity problem if the dependency changes or is hijacked.

Static analysis

No suspicious patterns detected.