T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:14- Finding
Unverified Remote Installer Executed Directly by Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Product Photography
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for AI product photography, but its quick start tells users to run a live remote installer directly in the shell before logging in.
Review this skill carefully before installing. Prefer a manual or pinned install path for the inference.sh CLI, verify checksums or signatures from a trusted source before login, and avoid sending private product images, unreleased designs, or sensitive prompts to hosted inference services unless that sharing is acceptable.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:283- Finding
Unpinned Third-Party Skill Installation Through Runtime Package Tooling
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl ... | shexecutes remote code directly from the network without giving the user a chance to inspect it first, creating a classic supply-chain/code-execution risk. Even with an install-note claiming checksum verification, the pattern still trusts a live fetched script and any compromise of the domain, CDN, TLS termination, or publishing pipeline could lead to arbitrary command execution on the user's machine.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login # Clean studio packshot infsh app run bytedance/seedream-4-5 --input '{
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill instructs users to run
infshcommands that send prompts and, later, image filenames/content to remote services, but the documentation does not clearly warn that user-provided prompts or images may be transmitted off-device. The install note explains installer behavior, but it does not disclose the data-sharing implications of using the hosted inference apps themselves.- Content