Security audit

Video Ad Specs

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent video-ad helper, but its install instructions ask users to run mutable remote code directly in a shell.

Review this skill before installing. Its video-ad guidance and infsh-only runtime scope are coherent, but avoid running the curl-to-shell Quick Start unless you independently trust and inspect the installer. Prefer a pinned, checksum-verified manual install of the CLI, and review any related skills before adding them with npx.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:14
Finding: Unverified Remote Installation Script Executed Directly by a Shell
Content: View full analysis
Remediation: View remediation
" ``` 4. Publish and pin the expected SHA-256 digest in the reviewed Skill rather than obtaining both the artifact and expected digest from the same mutable source. 5. Prefer signed releases and verify the signature with a trusted public key distributed through an independent channel. 6. Install the verified artifact using only user-level permissions. 7. Keep `infsh login` as a separate command and require explicit user approval before beginning authentication. 8. Provide manual inspection and installation steps as the default; if an installer remains available, treat it only as an optional alternative accompanied by a clear warning. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:247
Finding: Unpinned Third-Party Skill Installation Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: curl -fsSL https://cli.inference.sh | sh fetches executable code from a remote server and immediately runs it in the user's shell, creating direct remote code execution risk. If the hosting service, TLS trust chain, DNS, or distribution pipeline is compromised, the attacker gains code execution on systems following the skill.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login # Generate a vertical video ad scene infsh app run bytedance/seedance-1-5-pro --input '{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description includes a very broad trigger list with generic phrases like video ad, paid media, and video marketing, increasing the chance this skill auto-activates in unrelated contexts. Over-broad activation can route users into tool-using workflows unexpectedly, raising the chance of unintended command suggestions or execution paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs users to pipe a remote script from https://cli.inference.sh directly into sh, which is a classic unsafe installation pattern. Even with adjacent reassurance text, users are being told to execute downloaded code before independently verifying its contents or integrity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The skill recommends running npx skills add ... without pinning a specific version or commit, which causes users to fetch and execute whatever package/version is current at runtime. If the package, dependency chain, or referenced skill source is compromised, users could install or execute unreviewed code or content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: This unpinned npx skills add ... invocation introduces supply-chain risk because the resolved package and retrieved skill content may change over time. A later malicious or vulnerable update could be pulled automatically by anyone following the instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: Running npx against an unpinned package means arbitrary newer code can be executed in the user's environment without prior review. In a skill distribution context, this is a real supply-chain weakness even if the current package is legitimate.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: Because this command relies on an unversioned remote package and skill reference, the behavior is non-deterministic and could be altered by upstream compromise. Users may unknowingly execute changed code or install altered skills in future runs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.