ClawHub
Back to skill

Security audit

Prompt Engineering

Security checks for vulnerabilities and agentic risk

Overview

This prompt-engineering skill is mostly a coherent guide, but it tells users to run mutable remote installer and skill-install commands that deserve review before use.

Review before installing. Prefer a pinned manual download with an independently verified checksum or signature instead of `curl | sh`, and avoid the optional `npx skills add` commands unless you trust and inspect the exact package and skill versions being installed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unpinned Remote Installation Script Executed Directly by Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The installation command downloads the current response from https://cli.inference.sh and pipes it directly into sh. The script is neither pinned to an immutable version nor downloaded for inspection and independent integrity verification before execution.

Although the documentation states that the installer verifies the SHA-256 checksum of the downloaded CLI binary, that verification is performed by the remote installer itself. It does not authenticate the installer delivered through the pipeline. Consequently, the effective code executed by users can change after the Skill has been reviewed.

Installing the CLI is relevant to the declared inference-service workflow, but executing a mutable remote script directly is not the minimum-risk method necessary to provide that functionality.

Attack Path

  1. An attacker compromises the cli.inference.sh domain, its hosting account, deployment pipeline, DNS configuration, TLS termination, or another component capable of changing the returned script.
  2. The attacker replaces or modifies the installer response with malicious shell commands.
  3. A user follows the documented Quick Start command.
  4. curl retrieves the attacker-controlled response and sends it directly to sh.
  5. The malicious commands execute immediately with the permissions of the user running the command.
  6. The payload may read or modify accessible files, collect credentials, install additional components, or alter the user environment.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The accessible scope includes files, environment variables, credentials, authentication t ...[truncated 437 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh installation pipeline.
  2. Pin installation instructions to a specific, immutable CLI release.
  3. Download the release artifact without executing it:
    bash
    curl -fL -o infsh https://dist.inference.sh/path/to/pinned-release
  4. Publish the expected SHA-256 digest through a separately authenticated channel and require users to verify it locally:
    bash
    echo 'EXPECTED_SHA256  infsh' | sha256sum --check -
  5. Prefer signed release artifacts and verify signatures against a documented, pinned public key.
  6. Only after successful verification, set the executable bit and move the binary to a user-controlled installation directory.
  7. Avoid requiring administrator privileges; document a per-user installation location.
  8. If an installer remains available, instruct users to download and inspect it before execution rather than piping it directly into a shell.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:327
Finding

Unpinned Third-Party Components Invoked Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:327-336
Vulnerability Type: Insecure dependency and mutable supply-chain references
Risk Level: Medium

Vulnerable Code:

bash
# Video prompting guide
npx skills add inference-sh/skills@video-prompting-guide

# LLM models
npx skills add inference-sh/skills@llm-models

# Image generation
npx skills add inference-sh/skills@ai-image-generation

# Full platform skill
npx skills add inference-sh/skills@inference-sh

Technical Analysis

The commands invoke skills through npx without specifying an immutable npm package version or demonstrating that a previously reviewed local package must be used. Depending on the local environment and npx behavior, the package may be retrieved from a package registry and executed.

The referenced Skill components are also identified by mutable repository and Skill names rather than immutable commit hashes or integrity values. A future package or repository change can therefore introduce behavior that was not present during this audit.

Adding related Skills is optional and is not required for the core prompt-engineering documentation. Executing or installing mutable third-party content without an explicit review step exceeds the minimum dependency exposure necessary for the declared functionality.

Attack Path

  1. An attacker compromises the npm package used by npx, its publisher account, the referenced repository, or its release workflow.
  2. The attacker publishes a malicious package version or changes one of the mutable referenced Skills.
  3. A user runs one of the documented npx skills add commands.
  4. npx retrieves and executes the package, or the tool installs the modified Skill content.
  5. Malicious package code may execute during invocation, or hostile Skill instructions may become active when the installed Skill is later loaded.
  6. The attacker gains access within the permissions of the ...[truncated 725 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed, exact version rather than relying on the latest registry resolution.
  2. Install the package separately, verify its integrity, and invoke it with npx --no-install so the documented command cannot silently download a new version.
  3. Pin each referenced repository or Skill to an immutable commit hash or signed release.
  4. Record and verify package integrity hashes and repository signatures before execution or installation.
  5. Instruct users to inspect downloaded Skill files, allowed-tool declarations, scripts, and installation hooks before activation.
  6. Disable or avoid lifecycle scripts where supported unless they are required and have been reviewed.
  7. Present related Skills as optional resources and avoid suggesting immediate execution when a non-executable link can provide the same informational value.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to execute a remote script via curl ... | sh, which is a classic unsafe pattern because it grants immediate shell execution to content fetched over the network. Even with claims about checksum verification, this still depends on trusting the remote endpoint and script delivery path at execution time, creating significant supply-chain and remote code execution risk.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Well-structured LLM prompt
infsh app run openrouter/claude-sonnet-45 --input '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest-style description includes generic trigger phrases such as "better prompts," "prompt tips," and especially "how to prompt," which can overlap with ordinary conversation and broad AI-help requests. The trigger scope is not constrained by context or negative examples, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.