Press Release Writing

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

The skill is mostly press-release guidance, but it asks users to run mutable remote install commands that could execute unreviewed code.

Review the install path before using this skill. The writing guidance itself is low risk, but avoid running the curl-to-sh installer or unpinned npx commands unless you independently trust the publisher, inspect the downloaded content, and understand what the CLI login and research queries will send externally.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Remote Installer Downloaded and Executed Without Independent Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command retrieves a mutable script from an external URL and pipes it directly into `sh`. The downloaded content is executed immediately with the privileges of the invoking user, without allowing the user to inspect it or independently verify a pinned cryptographic digest. The document claims that the installer verifies the SHA-256 checksum of the binary it subsequently downloads. This does not establish the integrity of the installer itself. A compromised installer could omit or bypass verification, substitute its own checksum, download a different payload, or perform unrelated malicious operations before installing the expected CLI. Potential compromise points include the remote domain, hosting infrastructure, CDN, DNS resolution, TLS endpoint, deployment credentials, and upstream release process. Because the retrieved response is mutable, its effective behavior can change after this Skill has been reviewed. Installing an executable CLI is not necessary for the Skill's core press-release formatting functionality. Although external research may support fact-checking, it should be optional and should not require unreviewed remote code execution. ### Attack Path 1. An attacker compromises the remote installation endpoint or its deployment, DNS, CDN, or release infrastructure. 2. The attacker modifies the response from `https://cli.inference.sh` to contain malicious shell commands. 3. A user follows the documented Quick Start command. 4. `curl` downloads the attacker's current payload and streams it directly to `sh`. 5. The shell executes the payload with the user's privileges and without prior inspection. 6. The payload can access user-readable data, modify user-writa ...[truncated 1045 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Direct users to a version-pinned release artifact from the documented official distribution source. 3. Publish the expected SHA-256 digest through a separate trusted and authenticated channel. 4. Require the artifact to be downloaded first and verified before any execution or installation occurs. 5. Provide a manual installation procedure that clearly identifies the destination path and required permissions. 6. Avoid requiring administrative privileges and install only within an appropriate user-controlled directory. 7. Separate installation from authentication so users can inspect and verify the installed binary before running `infsh login`. 8. Prefer an already approved research integration when available; the press-release writing functionality should remain usable without installing external software. 9. Document what information the CLI transmits during login and research operations so users can make an informed decision before using it. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:282
• Finding: Unpinned Third-Party Skills Installed Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:282-283` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@web-search npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis The related-Skill installation examples invoke `npx` and reference third-party content without pinning an exact reviewed version or integrity digest. These mutable references may resolve to content that differs from what existed when this project was audited. Executing package tooling can introduce supply-chain exposure through package lifecycle behavior, transitive dependencies, compromised publisher accounts, registry compromise, or later malicious releases. The referenced Skills can also introduce new instructions and tool permissions that are outside the reviewed scope of this project. The two related Skills are optional enhancements and are not necessary for generating or formatting a press release. Recommending their direct installation therefore expands the dependency and trust boundary beyond the minimum required for the declared functionality. ### Attack Path 1. An attacker compromises a relevant package, publisher account, repository, registry, or transitive dependency. 2. The attacker publishes malicious content under the mutable identifier referenced by the documentation. 3. A user follows one of the recommended `npx skills add` commands. 4. `npx` resolves and retrieves the current external package and associated dependencies. 5. Package execution or installation behavior runs with the invoking user's privileges. 6. Malicious installation logic may access local files or alter the environment, while a malicious installed Skill may influence later Agent behavior or request additional tool access. ### Impact Assessment The immediate privileges are those of the user invoking `npx`. Depending on the behavior of the resolved package and its depen ...[truncated 586 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly mark the related Skills as optional and unnecessary for the core functionality. 2. Pin each dependency to an exact, reviewed version or immutable commit identifier. 3. Provide cryptographic integrity values and instructions for verifying downloaded content. 4. Explicitly identify the expected registry, publisher, and source repository. 5. Review the package, its lifecycle scripts, transitive dependencies, and installed Skill instructions before recommending it. 6. Disable package lifecycle scripts where supported and where they are not required. 7. Prefer downloading reviewed artifacts without executing package tooling automatically. 8. Re-audit dependency updates before changing pinned versions. 9. Document the permissions, tools, and outbound data flows introduced by each optional Skill. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Research for fact-checking and context
infsh app run tavily/search-assistant --input '{

• Confidence: 98% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` streams remote content directly into a shell, which is a classic arbitrary code execution pattern. Although the text claims checksum verification occurs, the verification logic itself is delivered by the same untrusted script, so a compromised server, CDN, or upstream distribution path could still execute malicious code on the user's machine.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad phrases like 'announcement', 'company news', and 'press statement', which can cause the skill to activate in contexts beyond explicit user intent. Over-broad activation increases the chance that external-tool-enabled guidance is surfaced unexpectedly, which can steer users toward unnecessary command execution or web-driven workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill recommends running `npx skills add ...` without pinning an exact package/version, which means users may install whatever the registry serves at execution time. That creates a supply-chain risk: a compromised package, malicious update, or typo-squatted dependency could execute code in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: This second `npx skills` invocation has the same issue: it pulls and executes package content without a pinned version. Even though it appears in a 'Related Skills' section, users may still copy-paste it, exposing themselves to remote code execution via package supply-chain compromise.

Static analysis

No suspicious patterns detected.