Speech To Text

• Analyzed: May 14, 2026, 3:32 AM
• Findings: 1
• Version: 0.1.5
• Hash: 3793af377f16f73a373bdf5e94ee3f598f59d17ac99e3a35af830b2769627fcb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the installation method described in `SKILL.md`. It instructs the AI agent to execute `curl -fsSL https://cli.inference.sh | sh`, which downloads and runs a shell script directly from a remote server. This practice is a significant security risk, creating a supply chain vulnerability and potential for Remote Code Execution (RCE) if the `cli.inference.sh` domain or server were compromised. While the documentation attempts to explain the script's benign nature, the method itself is inherently insecure and could lead to arbitrary code execution on the host system.