T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:14- Finding
Remote Installer Downloaded and Executed Without Independent Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Press Release Writing
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly press-release guidance, but it asks users to run mutable remote install commands that could execute unreviewed code.
Review the install path before using this skill. The writing guidance itself is low risk, but avoid running the curl-to-sh installer or unpinned npx commands unless you independently trust the publisher, inspect the downloaded content, and understand what the CLI login and research queries will send externally.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:282- Finding
Unpinned Third-Party Skills Installed Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl -fsSL https://cli.inference.sh | shstreams remote content directly into a shell, which is a classic arbitrary code execution pattern. Although the text claims checksum verification occurs, the verification logic itself is delivered by the same untrusted script, so a compromised server, CDN, or upstream distribution path could still execute malicious code on the user's machine.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login # Research for fact-checking and context infsh app run tavily/search-assistant --input '{
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad phrases like 'announcement', 'company news', and 'press statement', which can cause the skill to activate in contexts beyond explicit user intent. Over-broad activation increases the chance that external-tool-enabled guidance is surfaced unexpectedly, which can steer users toward unnecessary command execution or web-driven workflows.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
The skill recommends running
npx skills add ...without pinning an exact package/version, which means users may install whatever the registry serves at execution time. That creates a supply-chain risk: a compromised package, malicious update, or typo-squatted dependency could execute code in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
This second
npx skillsinvocation has the same issue: it pulls and executes package content without a pinned version. Even though it appears in a 'Related Skills' section, users may still copy-paste it, exposing themselves to remote code execution via package supply-chain compromise.- Content
Static analysis
No suspicious patterns detected.