Security audit
Security checks for vulnerabilities and agentic risk
The skill’s text-to-speech purpose is coherent, but its setup path asks users to run mutable remote installer code and optional unpinned skill-install commands, so it should be reviewed before installation.
Install only if you are comfortable trusting inference.sh’s installer and CLI with local execution and with processing the text you submit. Prefer a manually downloaded, version-pinned, independently verified CLI binary, avoid running `curl | sh`, avoid unpinned `npx` install commands, and do not submit secrets, regulated data, or confidential scripts unless that remote transfer is approved.
SKILL.md:17Unpinned Remote Installer Is Executed Directly by the Shell
SKILL.md:113Unpinned npx Runner and Mutable Skill Sources Create Supply-Chain Risk
curl -fsSL https://cli.inference.sh | sh downloads and immediately executes remote code in the user's shell, which is a classic supply-chain and remote code execution risk. Even with claims about checksum verification in surrounding text, the bootstrap script itself is not independently verified before execution, so compromise of the host, CDN, DNS, TLS termination, or publishing pipeline could lead to arbitrary command execution.
# Install CLI
curl -fsSL https://cli.inference.sh | sh && infsh login
# Generate speech
infsh app run infsh/kokoro-tts --input '{"text": "Hello, welcome to our product demo."}'
The manifest description embeds a very large set of broad trigger phrases such as text to speech, voice ai, generate speech, and natural voice, increasing the chance the skill is invoked for generic user requests. Over-broad routing can cause unintended tool use and remote data disclosure when users did not clearly consent to sending their text to an external service.
The skill encourages users to submit arbitrary text to infsh app run but does not clearly warn that the input is sent to a remote inference service for processing. This can lead users to provide sensitive, proprietary, or regulated content under the mistaken assumption that processing is local, creating confidentiality and compliance risk.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
No suspicious patterns detected.