Python Executor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:35 AM UTC
• Version: 0.1.5

Overview

This skill is purpose-aligned for sandboxed Python execution, but its documented installation path asks users to run mutable remote code directly in a shell.

Review before installing. The Python execution feature is coherent, but do not run the curl-to-shell quick start unless you trust inference.sh's installer delivery path. Prefer a separately downloaded, inspected, and verified CLI installer, and avoid sending secrets or private data through executed Python code unless you intend that code to contact external services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16
• Finding: Unverified Remote Installer Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command downloads mutable content from `https://cli.inference.sh` and pipes it directly into `sh`. The downloaded script is therefore executed before the user can inspect it or independently verify its integrity. The documentation states that the installer verifies the SHA-256 checksum of the binary it subsequently downloads. That does not establish the integrity of the installer itself: a compromised installer can omit or falsify verification, download another payload, or execute arbitrary commands directly. The effective code executed on the host can change after the Skill has been reviewed. Compromise of the hosting service, delivery infrastructure, or publishing credentials could consequently turn this installation command into an arbitrary-code-execution channel. Installing a CLI is relevant to the declared functionality, but piping an unpinned remote script directly into a shell is not the minimum-risk method required to perform that installation. ### Attack Path 1. An attacker compromises the remote installer, its hosting infrastructure, or credentials authorized to publish content at `cli.inference.sh`. 2. The attacker modifies the returned shell script to include malicious commands. 3. A user or agent follows the documented quick-start command. 4. `curl` retrieves the attacker-controlled content and immediately passes it to `sh`. 5. The malicious commands execute with the privileges of the account running the installation. 6. The payload can access files, environment variables, credentials, and network resources available to that account. It may also tamper with the installed `infsh` binary or intercept the subsequent `infsh login` operation. ### Impact Assessment ...[truncated 831 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `curl | sh` installation pattern. - Pin the CLI to a specific immutable version. - Provide separate download, verification, and execution steps so the artifact can be inspected before use. - Publish checksums and preferably cryptographic signatures through an independently protected channel. - Require verification of the downloaded artifact before execution, for example: ```bash curl -fSLO https://dist.inference.sh/cli/<version>/infsh-<platform> curl -fSLO https://dist.inference.sh/cli/<version>/checksums.txt sha256sum --check checksums.txt --ignore-missing install -m 0755 infsh-<platform> "$HOME/.local/bin/infsh" infsh login ``` - Ensure the real artifact URL, filename, and verification procedure are documented precisely. - Avoid requesting elevated privileges and install into a user-controlled directory unless system-wide installation is explicitly necessary. - Sign release artifacts and document signature verification using a pinned public key. - Keep installation and authentication as separate operations so users can verify the installed executable before providing credentials. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:168
• Finding: Related Skill Installation Commands Use Unpinned Remote Sources<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 168-174 **Vulnerability Type**: Insecure dependency installation guidance **Risk Level**: Medium ### Vulnerable Code ```bash # AI image generation (for ML-based images) npx skills add inference-sh/skills@ai-image-generation # AI video generation (for ML-based videos) npx skills add inference-sh/skills@ai-video-generation # LLM models (for text generation) npx skills add inference-sh/skills@llm-models ``` ### Technical Analysis The optional installation examples identify related Skills by mutable repository and component references rather than immutable release versions or commit hashes. No integrity value or signature-verification procedure is supplied. Consequently, the code or instructions obtained by future executions may differ from what was available when this Skill was audited. If the upstream repository, distribution account, or dependency delivery path is compromised, users can receive malicious Skill content through commands that appear identical to the reviewed documentation. The audited file does not prove that the referenced Skills or `npx` package are currently malicious. The issue is the absence of immutable version pinning and integrity verification, which creates avoidable supply-chain exposure. ### Attack Path 1. An attacker compromises an upstream repository, maintainer account, release process, or package used by the installation command. 2. The attacker changes a referenced Skill or a component involved in resolving or installing it. 3. A user runs one of the documented commands without an immutable version or integrity check. 4. The tool resolves the current remote content rather than a specifically reviewed revision. 5. Malicious instructions or files are installed and may execute when the related Skill is loaded or invoked. ### Impact Assessment Impact depends on the permissions granted to the installed Skill and the behavior of the package tooling. Potenti ...[truncated 445 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin each related Skill to an immutable release or commit hash rather than a mutable name alone. - Document the expected publisher, source repository, and reviewed revision. - Provide cryptographic checksums or signatures where the installation system supports them. - Verify downloaded content before installation or execution. - Use lockfiles or equivalent integrity metadata for package-tool dependencies. - Make the optional and externally sourced nature of these installations explicit. - Review the permissions and contents of every related Skill independently before enabling it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Run Python code
infsh app run infsh/python-executor --input '{

• Confidence: 97% confidence
• Finding: The quick-start instructs users to pipe a remotely fetched script directly into `sh`, which executes unreviewed code from the network immediately. Even with claims about checksum verification, this pattern is dangerous because it prevents local inspection and creates a single-step remote code execution path if the distribution channel or hosting is compromised.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The manifest description includes very broad triggers such as `python`, `execute code`, `automation`, and `API calls`, which can match many common user requests and cause this high-risk skill to be selected too often. Because the skill executes arbitrary Python and advertises network-capable libraries, overbroad routing increases the chance of unnecessary code execution and data-handling exposure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The description promotes web scraping, API calls, and automation but does not warn that user-provided code may make outbound network requests or transmit data externally. In a code-execution skill, that omission can mislead users and agents into sending sensitive inputs, cookies, tokens, or derived data to third-party services.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
infsh app run infsh/python-executor --input '{
  "code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octocat\")\ndata = response.json()\nprint(json.dumps(data, indent=2))"
}'
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The skill recommends invoking `npx skills add ...` without pinning an exact package/version, which allows whatever version is current at execution time to be fetched and run. That creates a supply-chain risk if the upstream package is compromised or a breaking/malicious update is published.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This example also uses unpinned `npx skills`, causing dynamic retrieval and execution of the latest package version. In agent/tooling contexts, that undermines reproducibility and can expose users to malicious or tampered package updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: A third unpinned `npx skills` invocation repeats the same package-resolution risk: code from the registry is executed without a fixed version constraint. This is especially risky in documentation because users may copy-paste it directly.

Static analysis

No suspicious patterns detected.