Video Prompting Guide

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 AM UTC
• Version: 0.1.5

Overview

The skill is mostly a video prompting guide, but it tells users to run a live remote installer and optional unpinned skill installs, creating supply-chain risk beyond the guide itself.

Review the CLI installer and any related skills before running the documented commands. Prefer downloading and verifying the installer separately, avoid running it with administrator privileges, and pin or inspect any external skills before adding them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Remote Installer Is Downloaded and Executed Without Prior Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

Technical Analysis

The command pipes a mutable HTTP response directly into a shell. The downloaded installer is neither saved for inspection nor authenticated against a checksum or signature known before execution. Although the document states that the installer verifies the CLI binary it subsequently downloads, that process does not independently authenticate the installer itself.

If the remote server, distribution infrastructure, DNS resolution, or applicable TLS trust chain is compromised, an attacker can replace the response with arbitrary shell commands. Those commands execute with all permissions held by the user following the guide. The -f and -s options also suppress some diagnostic output, reducing visibility into failures or unexpected server behavior.

CLI installation and authentication are not necessary to provide the Skill's declared video-prompting guidance. Consequently, this execution flow exceeds the minimum privileges required for the core functionality.

Attack Path

1. An attacker compromises or gains control over cli.inference.sh or infrastructure capable of changing its response.
2. The user copies and executes the documented Quick Start command.
3. curl retrieves the attacker-controlled response.
4. The pipe passes the response directly to sh without local inspection or independent verification.
5. The malicious response executes with the invoking user's privileges.
6. The payload can access user-readable data, modify user-owned files, steal credentials, install persistence where permitted, or alter the subsequently invoked infsh executable.
7. The chained infsh login command may expose an additional authentication opportunity if the install ...[truncated 669 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation pattern from the Quick Start instructions.
2. Keep CLI installation and login optional and separate from the prompting guide.
3. Direct users to a specific, immutable CLI release rather than a mutable installer endpoint.
4. Publish the expected SHA-256 digest in a separately controlled, versioned repository or signed release manifest.
5. Require users to download the artifact, verify its digest or cryptographic signature, and only then execute or install it.
6. Pin the installer and binary versions so a previously reviewed instruction cannot silently retrieve a different payload.
7. Document the exact files, directories, network endpoints, and permissions used by the installer.
8. Explicitly warn users not to run installation commands with administrator or root privileges.
9. If an installation script remains available, instruct users to save and inspect it before execution rather than piping it directly into a shell.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:222

Finding

Unpinned External Skill and Package Installation Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:222-236
Vulnerability Type: Insecure dependency and supply-chain usage
Risk Level: Medium

Vulnerable Code:

bash

# Generate videos
npx skills add inference-sh/skills@ai-video-generation

# Google Veo specific
npx skills add inference-sh/skills@google-veo

# Generate images for image-to-video
npx skills add inference-sh/skills@ai-image-generation

# General prompt engineering
npx skills add inference-sh/skills@prompt-engineering

# Full platform skill
npx skills add inference-sh/skills@inference-sh

Technical Analysis

These commands invoke npx and install externally maintained Skills using references that are not pinned to immutable package versions, release digests, or commit hashes. The version of the package resolved by npx is also not specified in the documented command.

Mutable dependency references allow content to change after this Skill has been audited. A compromised package publisher, source repository, dependency account, or distribution channel could therefore cause later users to retrieve content different from what was originally reviewed. The external package and referenced Skills are not included in this project, so their behavior cannot be validated from the audited artifact.

Installing additional Skills and invoking package tooling are optional extensions rather than minimum requirements for providing video-prompting guidance.

Attack Path

1. An attacker compromises the publisher account, package resolved by npx, referenced Skill repository, or upstream distribution channel.
2. The attacker publishes or substitutes a malicious version under a mutable dependency reference.
3. A user follows one of the Related Skills commands.
4. npx resolves external tooling, and the tooling retrieves the externally controlled Skill reference.
5. Malicious package lifecycle behavior or unsafe Skill content is installed ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package invoked through npx to an explicitly reviewed version.
2. Pin every external Skill to an immutable release, content digest, or full commit hash.
3. Record the expected source repository and cryptographic digest for each dependency.
4. Review the package's lifecycle scripts and each referenced Skill before recommending installation.
5. Use lockfiles or an equivalent verified dependency manifest where supported.
6. Configure package tooling to reject unexpected lifecycle scripts where those scripts are unnecessary.
7. Present related Skills as optional dependencies and explain the permissions and external content they introduce.
8. Periodically re-audit pinned versions before updating them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Piping a remotely fetched script directly into sh executes unreviewed code from the network immediately, creating a classic supply-chain and remote-code-execution risk. Even though the note claims checksum verification and benign behavior, users are still instructed to trust and execute a live script before independently inspecting it, which is dangerous in documentation intended for broad use.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash

curl -fsSL https://cli.inference.sh | sh && infsh login

# Well-structured video prompt
infsh app run google/veo-3-1-fast --input '{

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.