T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:16- Finding
Unverified Remote Installer Is Piped Directly Into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Speech To Text
Security checks for vulnerabilities and agentic risk
Overview
This speech-to-text skill is coherent, but its install instructions tell users to execute a remote installer directly and suggest mutable skill-install commands, which warrant careful review before use.
Install only if you trust inference.sh and are comfortable with hosted processing of your audio or video. Prefer a manual, checksum-verified CLI install, inspect the installer before running it, complete login only after verification, and avoid the optional npx related-skill commands unless you intentionally want to add those additional skills.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:108- Finding
Unpinned npx and Remote Skill Installation Commands Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl ... | shexecutes remote script content directly without giving the user a chance to inspect what will run, creating a classic supply-chain and remote-code-execution risk if the distribution endpoint, TLS chain, or upstream hosting is compromised. The surrounding note about checksum verification does not mitigate this specific one-line command because the fetched installer script itself is what gets executed immediately.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login infsh app run infsh/fast-whisper-large-v3 --input '{"audio_url": "https://audio.mp3"}'
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description lists broad triggers such as "transcription," "whisper," and "subtitles generation" without clear constraints or exclusion conditions. These phrases are generic enough to collide with ordinary conversation or unrelated tasks, increasing the chance of unintended skill activation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs users to provide
audio_urlandvideo_urlinputs to a third-party service, but it does not clearly warn that user-supplied media URLs and their content are transmitted off-platform for external processing. In a transcription context, this can expose sensitive recordings, meetings, interviews, or private media without adequate informed consent.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.