Newsletter Curation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

The skill’s newsletter guidance is coherent, but its install and related-skill commands rely on mutable remote code paths that users should review before installing.

Review the remote installer before running it, prefer manual download with independent checksum or signature verification, avoid elevated shells, and treat the X-posting and related-skill install examples as actions that may affect external accounts or install additional mutable instructions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14

Finding

Unverified Remote Installer Executed Directly by Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The installation instruction downloads a mutable shell script from an external URL and immediately passes it to sh. The command does not pin an installer version, verify a cryptographic signature, compare the installer against a trusted checksum, or allow the user to inspect it before execution.

The subsequent statement that the installer verifies the downloaded CLI binary does not address this vulnerability: the installer itself executes before any described binary verification occurs. A malicious installer could bypass or falsify its own checksum checks.

Although installing the CLI supports the Skill's declared use of infsh, executing an unverified remote script is not necessary and exceeds a reasonable minimum-trust installation model. The repository does not contain the installer, so its effective behavior can change after this Skill has been audited.

Attack Path

1. A user follows the documented Quick Start command.
2. curl requests the current response from https://cli.inference.sh.
3. An attacker who compromises the hosting service, deployment credentials, domain, or another relevant delivery component substitutes malicious shell content.
4. The response is streamed directly into sh without local validation.
5. The malicious commands execute with all privileges available to the user running the installation command.
6. The payload may access user-readable data, modify files, install additional tooling, steal credentials available to the process, or establish persistence where the user has permission.

Impact Assessment

Successful exploitation provides arbitrary command execution as the invoking user. The accessible scope may inc ...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pipeline.
2. Pin the CLI to an explicit, reviewed version and platform-specific artifact.
3. Download the artifact to a local file without executing it.
4. Verify it against a checksum distributed through an independently trusted or version-controlled channel. Prefer a cryptographic signature with a pinned public key.
5. Abort installation on any verification failure.
6. Install the verified artifact explicitly using normal user privileges; do not request administrator privileges unless strictly required.
7. Document manual inspection and installation steps.
8. If a shell installer remains available, download it separately, pin its immutable version, verify its signature, and only then execute it.
9. Do not treat checksums retrieved from the same mutable, potentially compromised delivery origin as sufficient protection.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:288

Finding

Unpinned npx Runner and Skill Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 288–290
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

npx skills add inference-sh/skills@email-design
npx skills add inference-sh/skills@content-repurposing
npx skills add inference-sh/skills@seo-content-brief

Technical Analysis

These commands invoke the skills package through npx without specifying an exact reviewed package version. Depending on the local environment and npx behavior, the package runner may retrieve and execute the latest package content from a configured registry.

The referenced Skills are also identified by mutable names rather than immutable commit hashes, signed releases, or integrity-pinned artifacts. Consequently, both the installer behavior and installed Skill content may differ from the versions that were originally reviewed.

This creates a supply-chain trust boundary involving the package registry, package namespace, publisher accounts, source repository, and release process. A compromised publisher account, malicious future release, registry compromise, or ownership transfer could cause users to retrieve unsafe content.

Attack Path

1. An attacker compromises the package publisher, registry entry, upstream repository, or another relevant release channel.
2. The attacker publishes a malicious version of the unpinned skills runner or modifies one of the referenced mutable Skills.
3. A user runs one of the documented npx skills add commands.
4. npx resolves and retrieves the current package version rather than a previously audited immutable version.
5. Package-runner code executes with the invoking user's privileges, or attacker-controlled Skill instructions are installed.
6. The malicious component can perform actions permitted to the package runner or later influence an agent when the installed Skill is loaded.

Impact Assessment

...[truncated 512 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills package runner to an exact reviewed version, for example through an exact package version rather than an unqualified npx skills invocation.
2. Pin each referenced Skill to an immutable commit or cryptographically verified release.
3. Use lockfiles and package integrity metadata where supported.
4. Configure an explicitly trusted registry and reject unexpected registry overrides.
5. Review package lifecycle scripts and disable them where they are unnecessary.
6. Verify publisher identity, release signatures, and checksums before installation.
7. Execute installation with standard user privileges in a constrained environment.
8. Periodically review pinned versions and update them only after security validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote install script via curl ... | sh, which is a classic unsafe pattern because it runs network-fetched code immediately in the user's shell without prior inspection. Even though the document claims checksum verification and limited installer behavior, compromise of the distribution endpoint, transport chain, or install script could lead to arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Find content to curate
infsh app run tavily/search-assistant --input '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description lists triggers such as "newsletter," "weekly digest," and "content curation," which are common phrases that can appear in ordinary discussion rather than a clear skill invocation. The file does not provide exclusion conditions or narrower context to distinguish when the skill should activate versus when those topics are merely being discussed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames this skill as newsletter curation, formatting, commentary, cadence, and subscriber growth strategy. At L253-L257, the skill invokes x/post-create to create a post on X, which is an external social publishing action rather than newsletter curation itself; while promotion is discussed, executing a social-posting tool is a distinct capability not clearly justified by the skill's stated scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The markdown includes a command that creates a social post via x/post-create, which could affect a user's public presence or publish content externally, but the surrounding documentation does not explicitly warn the user about that behavior. Because this is a skill description, a brief disclosure would help users understand that the example may create or prepare outward-facing social content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.