Security audit

Product Changelog

Security checks for vulnerabilities and agentic risk

Overview

The changelog skill is mostly coherent, but its setup guidance includes high-risk remote shell installation and unpinned third-party skill installs that users should review carefully.

Install only if you trust inference.sh and are comfortable running its installer and logging into its CLI. For lower risk, use the changelog-writing guidance without running the Quick Start, avoid the unpinned related-skill installs, and prefer a manually downloaded, version-pinned, independently verified CLI package.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:14
Finding: Mutable Remote Installation Script Executed Directly by a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:264
Finding: Unpinned Third-Party Skills Installed Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The skill instructs users to execute curl -fsSL https://cli.inference.sh | sh, which pipes remote network content directly into a shell. Even with adjacent claims about checksum verification, this pattern creates a high-risk remote code execution path because users are encouraged to trust and run a fetched script before independently verifying its contents or integrity.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login # Generate a feature announcement visual infsh app run falai/flux-dev-lora --input '{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger list is broad and includes generic phrases like 'product update' and 'feature announcement', which can cause the skill to activate in contexts beyond narrowly scoped changelog work. Over-broad invocation increases the chance that a tool-enabled skill is selected unnecessarily, exposing users to unrelated external-command guidance and expanding attack surface.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.