Web Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:34 AM UTC
• Version: 0.1.5

Overview

The skill's web-search purpose is coherent, but it asks users to run mutable remote installer code and optional unpinned remote skill installs.

Review the installer before running it, prefer a manual pinned download with independent checksum or signature verification, and do not run the install command with sudo or root privileges. Treat all searches, URLs, extracted pages, and LLM prompts as data sent to third-party services, and avoid secrets or internal-only resources. Skip or pin the optional npx skill installs unless you have separately reviewed them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16
• Finding: Mutable Remote Installation Script Is Piped Directly Into a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable code:** ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation instruction downloads a mutable script from an external server and immediately executes it with `sh`. The package contains no local copy of the installer, expected digest, signature, or pinned release against which the downloaded script can be independently validated before execution. Although the documentation states that the installer verifies the downloaded binary's SHA-256 checksum and does not request elevated permissions, that verification is performed by the same remotely retrieved script. An attacker who controls the installer endpoint, its hosting infrastructure, or a trusted deployment account could alter both the installation behavior and any checksum source it trusts. Installation of a CLI may be necessary for the declared web-search functionality, but piping mutable network content directly into a shell exceeds the minimum execution exposure required. A manual download and independent signature or pinned-digest verification would provide the required functionality without granting an unaudited response immediate shell execution. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its publishing pipeline, DNS/TLS termination, or an authorized deployment account. 2. The attacker replaces the installation response with a malicious shell script. 3. A user follows the documented quick-start command. 4. `curl` sends the response directly to `sh`, executing it without review or independent integrity validation. 5. The payload runs with all permissions of the invoking account and may modify user files, steal accessible credentials, install a substituted `infsh` executable, or establish persistence where the user has write acce ...[truncated 848 chars]
• Remediation: ## Remediation Suggestions - Replace the `curl | sh` instruction with a version-pinned binary or package download. - Publish signed release artifacts and verify them using a trusted public key distributed separately from the download endpoint. - Provide a hardcoded SHA-256 digest for each pinned platform artifact. Do not retrieve both the artifact and its authoritative digest from the same mutable deployment path. - Download into a temporary file first, verify its signature or pinned digest, and only then install it: ```bash curl -fL --proto '=https' --tlsv1.2 -o infsh \ 'https://dist.inference.sh/cli/releases/<pinned-version>/infsh-<platform>' printf '%s %s\n' '<pinned-sha256>' infsh | sha256sum -c - install -m 0755 infsh "$HOME/.local/bin/infsh" ``` - Keep installation and authentication as separate, explicit steps so users can inspect the installed binary before providing credentials. - If an installer script remains available, pin its version and digest, publish its source in the reviewed package, and instruct users to inspect and verify it before execution. - Clearly warn users not to run installation commands as root or through `sudo`.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:129
• Finding: Unpinned npx-Based Skill Installation Introduces Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 129–135 **Vulnerability Type**: Insecure dependencies **Risk Level**: Medium **Vulnerable code:** ```bash # Full platform skill (all 150+ apps) npx skills add inference-sh/skills@inference-sh # LLM models (combine with search for RAG) npx skills add inference-sh/skills@llm-models # Image generation npx skills add inference-sh/skills@ai-image-generation ``` ### Technical Analysis These commands invoke `npx skills` without pinning the `skills` package to an exact version or verified integrity value. Depending on the local npm environment, `npx` may download and execute the currently resolved package release. The installed skill sources are also referenced symbolically rather than by an immutable, reviewed commit digest. Consequently, future executions may run or install content different from what existed when this skill was audited. A malicious package release, compromised publisher account, or compromised upstream skill repository could introduce attacker-controlled instructions or executable content. The commands appear only under “Related Skills” and are not necessary for the declared Tavily/Exa web-search functionality. Their inclusion expands the trusted supply chain beyond the minimum dependencies required by this skill. ### Attack Path 1. An attacker compromises the publisher or distribution path for the package resolved as `skills`, or compromises the referenced upstream skill repository. 2. The attacker publishes a malicious version or changes content addressed by a mutable reference. 3. A user copies one of the documented `npx skills add` commands. 4. `npx` resolves and may execute the unpinned package, while the command imports upstream skill content not bound to a reviewed commit. 5. Malicious package lifecycle behavior, CLI logic, or imported skill instructions execute or become available with the invoking user's permissions. 6. The re ...[truncated 727 chars]
• Remediation: ## Remediation Suggestions - Remove unrelated skill-installation commands from this narrowly scoped web-search skill, or place them in non-executable reference documentation with an explicit supply-chain warning. - Pin the `npx` package to a reviewed exact version, for example `npx --yes skills@<exact-version> ...`, and maintain an audited lockfile where possible. - Pin upstream repositories or skill bundles to immutable commit hashes or signed release tags rather than mutable names. - Verify npm provenance, package integrity metadata, publisher identity, and release signatures before recommending execution. - Prefer a locally installed, lockfile-controlled CLI over on-demand `npx` execution. - Use an isolated, unprivileged environment for third-party skill installation and review imported files before enabling them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain

Content

## Quick Start

```bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Search the web
infsh app run tavily/search-assistant --input '{"query": "latest AI developments 2024"}'

• Confidence: 98% confidence
• Finding: `curl -fsSL https://cli.inference.sh | sh` pipes a remote script directly into a shell, which executes code before the user can inspect it. If the hosting domain, CDN, TLS termination, or upstream distribution path is compromised, users may run arbitrary attacker-controlled code; the nearby reassurance text does not eliminate that risk because the bootstrap script itself is what is being trusted.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description includes very broad trigger phrases such as `research`, `agents`, `search assistant`, and `web scraping`, which can cause the skill to match many common prompts. Over-broad routing increases the chance the agent invokes this skill unexpectedly and sends user queries or URLs to external services without clear intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description and introductory section do not clearly warn that user queries and supplied URLs are transmitted to third-party services (Tavily, Exa, and inference.sh). In a search/extraction skill, this omission is significant because users may provide sensitive prompts, internal URLs, or proprietary research targets assuming processing is local.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The skill recommends running `npx skills add inference-sh/skills@inference-sh` without a pinned version, so consumers will fetch whatever package version is current at execution time. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may install unreviewed code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This `npx skills add` invocation is unpinned and therefore depends on the latest upstream content at runtime. Even in documentation, instructing users to install mutable remote code increases exposure to dependency hijacking or malicious updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The command at this location also installs remote skill content without version pinning, making installs non-reproducible and vulnerable to upstream compromise. Because `npx` executes fetched package code, a malicious package update could immediately affect users.