{"data":{"skill":{"slug":"101-skills-agent-tools","name":"agent-tools","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/tools/agent-tools/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"b10a4e62-9e5b-4738-a1f1-0cfd93005eab","skill_id":"03062815-3455-4009-ad6a-12db85f383fa","version":5,"content_hash":"v3:d71c7417a35d5c2624161bd2fe8de8a41a362128:1c329eebf67dd1a21b090dff738948c1590f919f6e808829b5c4f3b7b5ef6e79:553edc5b2fe2263a43e20d3bda9f0bdce001f5f6945b3b32abbb9c478ff86643:736b696c6c732f3130312d736b696c6c732f6167656e742d746f6f6c73:6908d22336bae0e5d721e67ced19f2f6","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"The documentation contains four remote installer commands that pipe downloaded content directly into a shell, plus an unpinned package installation and a remote-data command substitution. Most other detections are Markdown examples, documentation links, placeholder credentials, or intentional user-selected paths. The skill also permits automatic cloud uploads and social account changes without requiring explicit confirmation.","remediation":[{"issue":"Remote installer content is piped directly into a shell.","severity":"critical","suggestion":"Replace every pipe-to-shell command with version-pinned download steps, published checksums, signature verification, and execution only after verification."},{"issue":"The manual installer derives a download URL from a remote manifest using shell substitution.","severity":"high","suggestion":"Use a structured manifest parser, restrict accepted hosts, pin a release version, and verify against a checksum obtained through an independent trust path."},{"issue":"The skill automatically uploads local paths to cloud applications.","severity":"medium","suggestion":"Require explicit user confirmation that names each local file, destination app, and data handling impact before any upload."},{"issue":"Commands can publish posts and perform other social account actions.","severity":"high","suggestion":"Require explicit confirmation immediately before every post, message, follow, like, or repost, and preview the exact action first."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/authentication.md","line_end":6,"line_start":6},{"file":"references/authentication.md","line_end":44,"line_start":44},{"file":"references/cli-reference.md","line_end":6,"line_start":6},{"file":"references/running-apps.md","line_end":152,"line_start":152},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":140,"line_start":140},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":142,"line_start":142},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146}]},{"factor":"env_access","evidence":[{"file":"references/authentication.md","line_end":30,"line_start":30},{"file":"references/authentication.md","line_end":53,"line_start":53},{"file":"references/cli-reference.md","line_end":79,"line_start":79}]},{"factor":"filesystem","evidence":[{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/running-apps.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":22,"line_start":20},{"file":"SKILL.md","line_end":25,"line_start":22},{"file":"SKILL.md","line_end":34,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":56,"line_start":38},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":74,"line_start":62},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":87,"line_start":86},{"file":"SKILL.md","line_end":103,"line_start":87},{"file":"SKILL.md","line_end":129,"line_start":103},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":34,"line_start":25}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command downloads mutable remote content and executes it immediately in a shell. A compromised host, route, or installer can execute arbitrary code."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall command executes remote content without allowing local inspection or independent verification. Compromise of the delivery path would provide arbitrary shell execution."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command directly executes a script downloaded from the network. It provides no pre-execution inspection or independently pinned integrity check."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary setup instructions execute an unaudited network response directly in the user's shell. A delivery compromise would permit arbitrary code execution."}],"high_findings":[{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.96,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The shell expands a URL parsed from a mutable remote manifest and passes it to curl. The same origin supplies checksums, so compromise can redirect and validate a malicious download."},{"title":"Unconfirmed Social Account Actions","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":98,"line_start":98}],"confidence":0.97,"description":"The skill exposes commands that can publish posts and identifies direct messages, follows, likes, and reposts as available actions. It provides no requirement to preview or confirm these external side effects.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The listed capabilities directly modify a connected social account, while the skill contains no confirmation or preview guardrail."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.86,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The inline Markdown contains an actual npx installation command for an unpinned remote skill. Running it introduces package and skill supply-chain execution risk."},{"title":"Automatic Local File Upload Without Confirmation","locations":[{"file":"references/running-apps.md","line_end":42,"line_start":21},{"file":"SKILL.md","line_end":73,"line_start":58}],"confidence":0.98,"description":"The skill states that local paths are automatically uploaded to cloud apps, including absolute, parent-directory, and home-directory paths. It does not require confirmation before transferring user files.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Both files explicitly document automatic uploads from local paths to cloud applications, and neither includes a confirmation requirement."}],"low_findings":[],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command downloads mutable remote content and executes it immediately in a shell. A compromised host, route, or installer can execute arbitrary code."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall command executes remote content without allowing local inspection or independent verification. Compromise of the delivery path would provide arbitrary shell execution."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command directly executes a script downloaded from the network. It provides no pre-execution inspection or independently pinned integrity check."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary setup instructions execute an unaudited network response directly in the user's shell. A delivery compromise would permit arbitrary code execution."}],"files_scanned":5,"total_lines":599,"audit_model":"codex","audited_at":"2026-07-12T09:41:56.762+00:00","created_at":"2026-07-14T15:53:48.969305+00:00","static_findings":[{"id":"network:references/authentication.md:6:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:references/authentication.md:44:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"export INFSH_API_KEY=your-api-key","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"| \"API key invalid\" | Check `INFSH_API_KEY` or re-login |","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":44,"severity":"critical","line_start":44},{"id":"network:references/cli-reference.md:6:hardcoded-url","file":"references/cli-reference.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","file":"references/cli-reference.md","pattern":"Hidden file in home directory","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","file":"references/cli-reference.md","pattern":"Hidden file access","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"medium","line_start":91},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","file":"references/cli-reference.md","pattern":"Generic API/secret keys","snippet":"| `INFSH_API_KEY` | API key (overrides config) |","category":"env_access","line_end":79,"severity":"high","line_start":79},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","file":"references/cli-reference.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"network:references/running-apps.md:152:hardcoded-url","file":"references/running-apps.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://cloud.inference.sh/...\",","category":"network","line_end":152,"severity":"low","line_start":152},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","file":"references/running-apps.md","pattern":"Path traversal sequence","snippet":"- Relative paths: `./image.png`, `../data/video.mp4`","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","file":"references/running-apps.md","pattern":"System reconnaissance","snippet":"| \"invalid input\" | Schema mismatch | Check `belt app get` for required fields |","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"external_commands","line_end":25,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Browse the app store | `belt app store` |","category":"external_commands","line_end":81,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Search apps | `belt app store search \"flux\"` |","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Filter by category | `belt app store --category image` |","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Get app details | `belt app get google/veo-3-1-fast` |","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run app | `belt app run google/veo-3-1-fast --input input.json` |","category":"external_commands","line_end":86,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run without waiting | `belt app run <app> --input input.json --no-wait` |","category":"external_commands","line_end":87,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Check task status | `belt task get <task-id>` |","category":"external_commands","line_end":103,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":129,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:28:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"# [inference.sh](https://inference.sh)","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![[inference.sh](https://inference.sh)](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO https://dist.inference.sh/cli/checksums.txt","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:140:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Agent Skills Overview](https://inference.sh/blog/skills/skills-overview) - The open standard for ","category":"network","line_end":140,"severity":"low","line_start":140},{"id":"network:SKILL.md:141:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Getting Started](https://inference.sh/docs/getting-started/introduction) - Introduction to infere","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:SKILL.md:142:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [What is inference.sh?](https://inference.sh/docs/getting-started/what-is-inference) - Platform ov","category":"network","line_end":142,"severity":"low","line_start":142},{"id":"network:SKILL.md:143:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":143,"severity":"low","line_start":143},{"id":"network:SKILL.md:144:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CLI Setup](https://inference.sh/docs/extend/cli-setup) - Installing the CLI","category":"network","line_end":144,"severity":"low","line_start":144},{"id":"network:SKILL.md:145:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Workflows vs Agents](https://inference.sh/blog/concepts/workflows-vs-agents) - When to use each","category":"network","line_end":145,"severity":"low","line_start":145},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Why Agent Runtimes Matter](https://inference.sh/blog/agent-runtime/why-runtimes-matter) - Runtime","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:33:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":18,"severity":"critical","line_start":18}],"finding_verdicts":[{"id":"network:references/authentication.md:6:hardcoded-url","reason":"The fixed first-party URL is expected installation documentation. The unsafe pipe-to-shell behavior on the same line is assessed separately.","verdict":"false_positive","confidence":0.98},{"id":"network:references/authentication.md:44:hardcoded-url","reason":"The fixed first-party URL is expected reinstallation documentation. The unsafe pipe-to-shell behavior on the same line is assessed separately.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","reason":"This is a placeholder showing users how to set INFSH_API_KEY. It contains no real credential and does not read or transmit other environment variables.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","reason":"This troubleshooting row only names INFSH_API_KEY. It neither contains a secret nor performs environment access.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","reason":"The command downloads mutable remote content and executes it immediately in a shell. A compromised host, route, or installer can execute arbitrary code.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","reason":"The reinstall command executes remote content without allowing local inspection or independent verification. Compromise of the delivery path would provide arbitrary shell execution.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/cli-reference.md:6:hardcoded-url","reason":"A first-party installation URL is normal documentation and is not independently dangerous. The execution risk from piping it to a shell is covered by its blocker finding.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","reason":"The command writes generated Fish completion data to the standard user completion directory. It does not inspect unrelated hidden files or conceal a payload.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","reason":"This is an explicit shell completion installation path selected by the user. The command does not access sensitive hidden configuration.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","reason":"The line documents the supported API key variable without reading it or exposing a value. No credential is embedded.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","reason":"The installation command directly executes a script downloaded from the network. It provides no pre-execution inspection or independently pinned integrity check.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/running-apps.md:152:hardcoded-url","reason":"This is an abbreviated example result URL showing where generated output may be hosted. It is not an executable request or suspicious endpoint.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","reason":"The parent-directory path is a documented user-supplied media path, not untrusted input used to bypass a path boundary. Automatic upload risk is assessed semantically.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","reason":"The command retrieves a selected app's required input schema for troubleshooting. It does not enumerate host, network, process, or account information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The inline Markdown contains an actual npx installation command for an unpinned remote skill. Running it introduces package and skill supply-chain execution risk.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The detector matched the opening marker of a Markdown Bash block. The marker itself performs no shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The detector matched a Markdown code fence delimiter. It is formatting syntax, not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The backticks format the dist.inference.sh host as inline documentation. They do not execute the enclosed text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"This finding begins at a quoted Markdown code fence. The fence is not Ruby or shell backtick execution; the separate command substitution finding covers the executable construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The snippet is the closing marker for a quoted Markdown code block. It does not invoke an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The snippet is an opening Markdown Bash fence. It is documentation formatting rather than a backtick execution expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The snippet is a closing Markdown code fence. No command is executed by the fence itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The snippet is an opening Markdown Bash fence. It does not represent Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The detector matched a Markdown code fence delimiter. The delimiter has no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks format a documented belt command in a table. They are not shell command substitution or Ruby execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This is an inline Markdown example for searching the app store. Markdown backticks do not execute the command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This is a formatted CLI example for filtering apps. It contains no Ruby backtick expression.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The inline command is documentation for retrieving app metadata. The surrounding backticks are Markdown formatting.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The backticks format a sample-generation command in documentation. They do not execute it.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The documented belt app run command is intentionally shown as inline code. The matched backticks have no execution semantics.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"This is a formatted asynchronous run example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The backticks only format a task status command in a Markdown table. They do not execute the command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The matched snippet is an opening Markdown Bash fence. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:shell-command-substitution","reason":"The shell expands a URL parsed from a mutable remote manifest and passes it to curl. The same origin supplies checksums, so compromise can redirect and validate a malicious download.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","reason":"The matched line is a Markdown Bash fence, not a programming-language template literal. The real nested shell substitution on line 28 has its own confirmed finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:9:hardcoded-url","reason":"This is the first-party project link in a heading. It does not initiate a hidden network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is a first-party illustrative image embedded in the documentation. No credential, local data, or tracking parameter is included.","verdict":"false_positive","confidence":0.93},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The fixed installation URL is not independently suspicious. The direct execution of its response is covered by the confirmed pipe-to-shell finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:22:hardcoded-url","reason":"This line links to the first-party installer while explaining its behavior. The URL itself does not execute content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"This explicit first-party URL downloads a checksum file as part of a manual installation. Its trust-model weakness is covered by the command-substitution finding and remediation.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The fixed first-party manifest URL is not independently dangerous. Parsing remote data into a shell argument is covered by the confirmed command-substitution finding.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:140:hardcoded-url","reason":"This is a visible first-party documentation link. It does not transmit secrets or run code.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:141:hardcoded-url","reason":"This is a visible first-party getting-started link. It is normal documentation content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:142:hardcoded-url","reason":"This is a visible first-party platform overview link. It performs no automatic network action.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:143:hardcoded-url","reason":"This is a first-party documentation link about applications. It is not a hidden endpoint or data transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:144:hardcoded-url","reason":"This is a visible first-party CLI setup link. It does not execute the linked installer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:145:hardcoded-url","reason":"This is a visible first-party article link. It has no executable or secret-bearing behavior.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:146:hardcoded-url","reason":"This is a visible first-party article link about agent runtimes. It does not create an unauthorized request.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","reason":"The manual installation explicitly moves the verified CLI binary into the conventional user-local executable directory. It does not conceal or inspect unrelated files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:33:hidden-file-access","reason":"The command writes to a standard user installation path with clear documentation. This is intended installation behavior, not covert hidden-file access.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","reason":"The primary setup instructions execute an unaudited network response directly in the user's shell. A delivery compromise would permit arbitrary code execution.","verdict":"confirmed","severity":"critical","confidence":0.99}],"semantic_findings":[{"title":"Automatic Local File Upload Without Confirmation","severity":"medium","locations":[{"file":"references/running-apps.md","line_end":42,"line_start":21},{"file":"SKILL.md","line_end":73,"line_start":58}],"confidence":0.98,"description":"The skill states that local paths are automatically uploaded to cloud apps, including absolute, parent-directory, and home-directory paths. It does not require confirmation before transferring user files.","confidence_reasoning":"Both files explicitly document automatic uploads from local paths to cloud applications, and neither includes a confirmation requirement."},{"title":"Unconfirmed Social Account Actions","severity":"high","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":98,"line_start":98}],"confidence":0.97,"description":"The skill exposes commands that can publish posts and identifies direct messages, follows, likes, and reposts as available actions. It provides no requirement to preview or confirm these external side effects.","confidence_reasoning":"The listed capabilities directly modify a connected social account, while the skill contains no confirmation or preview guardrail."}],"subject_marketplace_commit_sha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","subject_content_hash":"1c329eebf67dd1a21b090dff738948c1590f919f6e808829b5c4f3b7b5ef6e79","subject_tree_hash":"553edc5b2fe2263a43e20d3bda9f0bdce001f5f6945b3b32abbb9c478ff86643","subject_plugin_path":"skills/101-skills/agent-tools","audit_payload_hash":"6908d22336bae0e5d721e67ced19f2f6","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","contentHash":"1c329eebf67dd1a21b090dff738948c1590f919f6e808829b5c4f3b7b5ef6e79","treeHash":"553edc5b2fe2263a43e20d3bda9f0bdce001f5f6945b3b32abbb9c478ff86643","pluginPath":"skills/101-skills/agent-tools","auditPayloadHash":"6908d22336bae0e5d721e67ced19f2f6"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":6,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}