Storyboard Creation

• Analyzed: May 12, 2026, 3:41 AM
• Findings: 1
• Version: 0.1.5
• Hash: 26bd9b9d5a6b84acaef382e35c28da013d704f8023cc55be04243f4d5e222aa2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its installation method, which instructs the AI agent to execute `curl -fsSL https://cli.inference.sh | sh` from `SKILL.md`. While the stated purpose is benign (installing a CLI tool), this method introduces a significant supply chain risk, allowing arbitrary code execution if the remote script at `cli.inference.sh` were compromised. Additionally, the `allowed-tools: Bash(infsh *)` permission grants broad execution capabilities to the `infsh` command, which, while used benignly in the examples, could be exploited by a malicious user prompt.