Newsletter Curation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

The skill’s newsletter guidance is coherent, but its install and related-skill commands rely on mutable remote code paths that users should review before installing.

Review the remote installer before running it, prefer manual download with independent checksum or signature verification, avoid elevated shells, and treat the X-posting and related-skill install examples as actions that may affect external accounts or install additional mutable instructions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installer Executed Directly by Shell## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation instruction downloads a mutable shell script from an external URL and immediately passes it to `sh`. The command does not pin an installer version, verify a cryptographic signature, compare the installer against a trusted checksum, or allow the user to inspect it before execution. The subsequent statement that the installer verifies the downloaded CLI binary does not address this vulnerability: the installer itself executes before any described binary verification occurs. A malicious installer could bypass or falsify its own checksum checks. Although installing the CLI supports the Skill's declared use of `infsh`, executing an unverified remote script is not necessary and exceeds a reasonable minimum-trust installation model. The repository does not contain the installer, so its effective behavior can change after this Skill has been audited. ### Attack Path 1. A user follows the documented Quick Start command. 2. `curl` requests the current response from `https://cli.inference.sh`. 3. An attacker who compromises the hosting service, deployment credentials, domain, or another relevant delivery component substitutes malicious shell content. 4. The response is streamed directly into `sh` without local validation. 5. The malicious commands execute with all privileges available to the user running the installation command. 6. The payload may access user-readable data, modify files, install additional tooling, steal credentials available to the process, or establish persistence where the user has permission. ### Impact Assessment Successful exploitation provides arbitrary command execution as the invoking user. The accessible scope may inc ...[truncated 510 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` installation pipeline. 2. Pin the CLI to an explicit, reviewed version and platform-specific artifact. 3. Download the artifact to a local file without executing it. 4. Verify it against a checksum distributed through an independently trusted or version-controlled channel. Prefer a cryptographic signature with a pinned public key. 5. Abort installation on any verification failure. 6. Install the verified artifact explicitly using normal user privileges; do not request administrator privileges unless strictly required. 7. Document manual inspection and installation steps. 8. If a shell installer remains available, download it separately, pin its immutable version, verify its signature, and only then execute it. 9. Do not treat checksums retrieved from the same mutable, potentially compromised delivery origin as sufficient protection.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:288
• Finding: Unpinned npx Runner and Skill Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 288–290 **Vulnerability Type**: Insecure third-party dependency execution **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add inference-sh/skills@email-design npx skills add inference-sh/skills@content-repurposing npx skills add inference-sh/skills@seo-content-brief ``` ### Technical Analysis These commands invoke the `skills` package through `npx` without specifying an exact reviewed package version. Depending on the local environment and `npx` behavior, the package runner may retrieve and execute the latest package content from a configured registry. The referenced Skills are also identified by mutable names rather than immutable commit hashes, signed releases, or integrity-pinned artifacts. Consequently, both the installer behavior and installed Skill content may differ from the versions that were originally reviewed. This creates a supply-chain trust boundary involving the package registry, package namespace, publisher accounts, source repository, and release process. A compromised publisher account, malicious future release, registry compromise, or ownership transfer could cause users to retrieve unsafe content. ### Attack Path 1. An attacker compromises the package publisher, registry entry, upstream repository, or another relevant release channel. 2. The attacker publishes a malicious version of the unpinned `skills` runner or modifies one of the referenced mutable Skills. 3. A user runs one of the documented `npx skills add` commands. 4. `npx` resolves and retrieves the current package version rather than a previously audited immutable version. 5. Package-runner code executes with the invoking user's privileges, or attacker-controlled Skill instructions are installed. 6. The malicious component can perform actions permitted to the package runner or later influence an agent when the installed Skill is loaded. ### Impact Assessment ...[truncated 512 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` package runner to an exact reviewed version, for example through an exact package version rather than an unqualified `npx skills` invocation. 2. Pin each referenced Skill to an immutable commit or cryptographically verified release. 3. Use lockfiles and package integrity metadata where supported. 4. Configure an explicitly trusted registry and reject unexpected registry overrides. 5. Review package lifecycle scripts and disable them where they are unnecessary. 6. Verify publisher identity, release signatures, and checksums before installation. 7. Execute installation with standard user privileges in a constrained environment. 8. Periodically review pinned versions and update them only after security validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Find content to curate
infsh app run tavily/search-assistant --input '{

• Confidence: 98% confidence
• Finding: The skill instructs users to execute a remote install script via `curl ... | sh`, which is a classic unsafe pattern because it runs network-fetched code immediately in the user's shell without prior inspection. Even though the document claims checksum verification and limited installer behavior, compromise of the distribution endpoint, transport chain, or install script could lead to arbitrary code execution on the host.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description lists triggers such as "newsletter," "weekly digest," and "content curation," which are common phrases that can appear in ordinary discussion rather than a clear skill invocation. The file does not provide exclusion conditions or narrower context to distinguish when the skill should activate versus when those topics are merely being discussed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest frames this skill as newsletter curation, formatting, commentary, cadence, and subscriber growth strategy. At L253-L257, the skill invokes `x/post-create` to create a post on X, which is an external social publishing action rather than newsletter curation itself; while promotion is discussed, executing a social-posting tool is a distinct capability not clearly justified by the skill's stated scope.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The markdown includes a command that creates a social post via `x/post-create`, which could affect a user's public presence or publish content externally, but the surrounding documentation does not explicitly warn the user about that behavior. Because this is a skill description, a brief disclosure would help users understand that the example may create or prepare outward-facing social content.

Static analysis

No suspicious patterns detected.