Product Hunt Launch

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:50 PM UTC
• Version: 0.1.5

Overview

This Product Hunt launch skill is mostly coherent, but it asks users to run mutable remote installer and unpinned installation commands that can execute code on their machine.

Review carefully before installing. Prefer manual download and independent verification of the inference.sh CLI, avoid `curl | sh`, do not run the optional unpinned `npx skills add` commands unless you trust and review those packages, and avoid sending confidential launch plans, unreleased product details, customer names, or credentials in image prompts or search queries.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:14
• Finding: Unverified Remote Installer Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The command downloads a mutable script from `https://cli.inference.sh` and passes the response directly to `sh`. The remote content is executed before the user can inspect it or verify its integrity. The document states that the installer verifies the SHA-256 checksum of a subsequently downloaded binary. That does not establish the integrity of the initial bootstrap script: a compromised server, distribution pipeline, domain, or TLS endpoint could modify both the installation logic and any checksum it consumes. Installing the CLI may support the Skill's image-generation and research examples, but immediate remote shell execution is not the minimum access necessary. The Product Hunt guidance itself does not require local code execution, and the file already identifies manual installation and verification as an alternative. ### Attack Path 1. An attacker compromises the `cli.inference.sh` hosting environment, deployment pipeline, domain, or another component capable of changing the returned script. 2. A user or agent follows the Quick Start instructions. 3. `curl` retrieves the attacker-controlled response. 4. The pipe sends that response directly to `sh` without local inspection, version pinning, signature verification, or independent checksum validation. 5. The payload executes with all privileges available to the invoking user. 6. The payload can access user-readable credentials and files, modify writable configuration, install persistence within the user's scope, or replace the intended CLI. 7. The chained `infsh login` command is only reached if the remote script returns success; a malicious installer could instead imitate or manipulate the expected authentication process. ### Impact As ...[truncated 860 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern from the Quick Start instructions. 2. Link to a versioned release artifact rather than an unversioned installer endpoint. 3. Pin the expected release version and publish its SHA-256 digest through an independently protected channel. 4. Require users to download the artifact to a local file before execution: ```bash curl --fail --show-error --location \ --output infsh.tar.gz \ https://dist.inference.sh/cli/releases/<PINNED_VERSION>/infsh-<PLATFORM>.tar.gz printf '%s %s\n' '<EXPECTED_SHA256>' 'infsh.tar.gz' | sha256sum --check - ``` 5. Prefer cryptographic signature verification using a documented, pinned public key over an unauthenticated checksum alone. 6. Let users inspect downloaded installation scripts or binaries before installation. 7. Install only into a user-controlled directory without `sudo`, startup services, or background processes. 8. Keep installation and authentication as separate, explicit operations. Do not automatically invoke `infsh login` after running installation code. 9. Document what information the login process transmits and where credentials or tokens are stored. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:253
• Finding: Unpinned Third-Party Skill Installation Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 253–255 **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@web-search npx skills add inference-sh/skills@prompt-engineering ``` ### Technical Analysis These commands use `npx` to invoke the `skills` package and add three externally maintained skills. Neither the executable package nor the referenced skill content is pinned to an immutable package version, commit hash, or verified digest. Using `npx` may download and execute package tooling that is not already installed locally. Mutable package resolution and mutable skill references expand the supply-chain trust boundary beyond the reviewed project. Content retrieved when a user runs these commands may differ from the content that existed when `SKILL.md` was audited. The related skills are optional conveniences and are not necessary for the core Product Hunt launch guidance. Their unpinned installation therefore introduces avoidable dependency and instruction-supply-chain risk. ### Attack Path 1. An attacker compromises the package or account used to distribute the `skills` executable, one of its transitive dependencies, the referenced skill repository, or a mutable release reference. 2. The attacker publishes malicious package code or malicious Skill instructions under the expected identifier. 3. A user follows one of the documented `npx skills add` commands. 4. `npx` resolves and potentially downloads executable tooling using the package state available at execution time. 5. The installer executes with the invoking user's privileges and retrieves the mutable external Skill. 6. Malicious package code may act during installation, or hostile Skill content may later influence an agent when the added Skill is loaded. ### Impact Assessment If executable package tooling is compromised, the at ...[truncated 570 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly label all related-skill installation commands as optional and remove them from the primary workflow if they are unnecessary. 2. Pin the `skills` CLI to an explicitly reviewed version rather than allowing `npx` to resolve the current package: ```bash npx --yes skills@<PINNED_VERSION> add <PINNED_SKILL_REFERENCE> ``` 3. Pin every external Skill to an immutable, reviewed commit or release identifier rather than a mutable name or branch. 4. Verify package integrity using a lockfile, trusted registry integrity metadata, and independently published checksums or signatures where supported. 5. Review the complete dependency tree and the contents of each external Skill before recommending installation. 6. Prefer a locally installed, previously verified CLI over on-demand `npx` execution. 7. Run installation in a restricted environment without sensitive environment variables, unnecessary filesystem access, or elevated privileges. 8. Establish a repeatable update-review process instead of silently tracking the latest external package or Skill content. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate gallery hero image
infsh app run falai/flux-dev-lora --input '{

• Confidence: 98% confidence
• Finding: `curl ... | sh` executes a remote script directly from the network, creating a classic supply-chain and remote code execution risk. Even with the nearby note claiming checksum verification, users are still instructed to trust and execute an unaudited bootstrap script before reviewing its contents; if the host, CDN, TLS path, or script source is compromised, arbitrary code could run on the user's machine.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description lists generic triggers such as "launch strategy," "product launch," and "startup launch" without narrowing them to Product Hunt context. These phrases are broad enough to match ordinary discussion about launches and could cause unintended invocation outside the intended domain.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The image-generation examples transmit prompt content to an external service without clearly disclosing that prompts may contain sensitive product information. In this context, users preparing unreleased launches may include proprietary screenshots, roadmap details, or messaging that should not be sent to third parties by default.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: These examples send search queries to external services (`tavily/search-assistant`, later `exa/search`) without a clear privacy disclosure. If users include confidential launch plans, customer names, internal product details, or unreleased strategy in queries, that data may be transmitted to third-party providers unexpectedly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The skill mandates launch timing in Pacific Time and frames 12:01 AM PT as the recommended schedule. This is a locale-specific instruction presented as a default without explicitly offering adaptation for the user's region or clarifying that it is specific to Product Hunt's platform timing rules.

Static analysis

No suspicious patterns detected.