{"data":{"skill":{"slug":"101-skills-infsh-cli","name":"infsh-cli","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/tools/infsh-cli/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"476b2964-5f80-47a2-afc4-12a78ebdc74c","skill_id":"ad76e264-c244-4df4-bc02-c52537f288c1","version":2,"content_hash":"ca1cf5275967019dceca76cb6428d4bb","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"The skill documents useful inference.sh CLI workflows, but it includes multiple remote installer patterns that pipe downloaded content to a shell or derive binary downloads from a remote manifest. Several markdown backtick findings are false positives, but the confirmed risks include unsafe installation guidance, local file upload exposure, executable installation into the user PATH, and social media automation capabilities.","remediation":[{"issue":"Remote installer is piped directly to sh in SKILL.md and reference files.","severity":"critical","suggestion":"Replace pipe-to-shell installation with version-pinned package manager instructions or a manual download flow that requires checksum and signature verification before execution."},{"issue":"Manual installation uses command substitution based on a remote manifest.","severity":"high","suggestion":"Provide explicit per-platform download links, fixed versions, checksums, and signature verification commands without parsing remote data into a shell command."},{"issue":"Local file paths are automatically uploaded to remote inference.sh apps.","severity":"high","suggestion":"Require explicit user approval before every local file upload and warn when paths leave the current project directory."},{"issue":"Twitter/X automation commands can create public or account-affecting actions.","severity":"high","suggestion":"Require explicit confirmation for posts, DMs, follows, likes, retweets, and any use of authenticated social media accounts."},{"issue":"The skill recommends installing related skills through npx commands.","severity":"medium","suggestion":"Present related skills as documentation links and require user confirmation before installing any additional skill or package."},{"issue":"API key setup is documented without detailed handling safeguards.","severity":"medium","suggestion":"Add guidance to keep API keys out of prompts, logs, shell history, and shared files, and prefer secret management where available."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/authentication.md","line_end":6,"line_start":6},{"file":"references/authentication.md","line_end":44,"line_start":44},{"file":"references/cli-reference.md","line_end":6,"line_start":6},{"file":"references/running-apps.md","line_end":152,"line_start":152},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":142,"line_start":142},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":147,"line_start":147}]},{"factor":"env_access","evidence":[{"file":"references/authentication.md","line_end":30,"line_start":30},{"file":"references/authentication.md","line_end":53,"line_start":53},{"file":"references/cli-reference.md","line_end":79,"line_start":79}]},{"factor":"filesystem","evidence":[{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/running-apps.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":22,"line_start":20},{"file":"SKILL.md","line_end":25,"line_start":22},{"file":"SKILL.md","line_end":34,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":56,"line_start":38},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":74,"line_start":62},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":87,"line_start":86},{"file":"SKILL.md","line_end":88,"line_start":87},{"file":"SKILL.md","line_end":104,"line_start":88},{"file":"SKILL.md","line_end":130,"line_start":104},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":34,"line_start":25}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command explicitly pipes a remote HTTPS response into sh. That pattern can execute arbitrary remote code during installation and should be blocked until replaced."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall command repeats the pipe-to-shell pattern. Re-running a mutable remote script without inspection or pinning is a critical supply-chain risk."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command executes a remote script through sh without prior review. This is a direct pipe-to-shell pattern and a critical installer risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":20,"line_start":17}],"confidence":0.96,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command block contains curl piped to sh followed by login. The markdown label is noisy, but the command block includes a critical remote script execution instruction."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill prominently instructs curl -fsSL https://cli.inference.sh | sh. Directly executing a mutable remote installer is a critical publish-blocking pattern."}],"high_findings":[{"title":"Hardcoded URL","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.9,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL is used in an installer command that downloads a remote script and pipes it to sh. This creates a remote code execution supply-chain risk if the endpoint or transport is compromised."},{"title":"Hardcoded URL","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.9,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The reinstall guidance repeats the same remote installer URL piped directly to sh. The network dependency is security-relevant because the fetched script executes immediately."},{"title":"Hardcoded URL","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.9,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The hardcoded URL is part of an install command that downloads and executes a remote script. The URL is not just documentation because the command is intended to be run."},{"title":"Path traversal sequence","locations":[{"file":"references/running-apps.md","line_end":41,"line_start":41}],"confidence":0.74,"description":"- Relative paths: `./image.png`, `../data/video.mp4`","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The documentation says parent-relative paths are accepted for local file uploads. That can cause unintended upload of files outside the working directory if an agent uses an unsafe path."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":34,"line_start":25}],"confidence":0.86,"description":"> ```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The manual install block includes shell commands that download binaries and place an executable in the user PATH. It also uses dynamic command substitution to choose the download URL."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":74,"line_start":62}],"confidence":0.91,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The local file upload examples send local images, audio, and media paths to remote inference.sh apps. This is expected behavior, but it creates a real data exposure risk without explicit consent."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.91,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The command substitutes the result of a remote manifest request into a download command. A changed manifest or parsing issue can cause an unintended binary to be downloaded."},{"title":"Template literal with command substitution","locations":[{"file":"SKILL.md","line_end":34,"line_start":25}],"confidence":0.88,"description":"> ```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The manual install block includes command substitution that derives a binary URL from remote content. This is a risky installation pattern even though checksum verification is later suggested."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.91,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL is used in a curl command whose output is piped directly to sh. That makes the hardcoded endpoint part of a remote code execution installer path."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.87,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The command fetches a remote manifest and uses its parsed URL to download a binary. This network dependency directly controls which executable is installed."},{"title":"Hidden file in home directory","locations":[{"file":"SKILL.md","line_end":33,"line_start":33}],"confidence":0.79,"description":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","review_kind":"capability","source_category":"filesystem","source_severity":"high","confidence_reasoning":"The command moves a downloaded binary into ~/.local/bin, a hidden home-directory path commonly in PATH. That is a legitimate install location, but it installs an executable for future use."},{"title":"Automatic Local File Upload Guidance","locations":[{"file":"SKILL.md","line_end":74,"line_start":58},{"file":"references/running-apps.md","line_end":37,"line_start":21}],"confidence":0.9,"description":"The skill states that local files are automatically uploaded when a path is provided, including images, audio, and media examples. An agent could expose sensitive local files if it follows these instructions without explicit user approval.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The documentation explicitly describes automatic local file uploads and gives multiple local path examples. This is an intentional capability with a clear data exposure risk."},{"title":"Social Media Automation Capability","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":121,"line_start":120}],"confidence":0.86,"description":"The skill includes commands and related skills for posting to Twitter/X, sending DMs, following users, liking posts, and retweeting. These capabilities can enable spam, account abuse, or unauthorized public actions if used without explicit account-owner consent.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The cited lines directly list Twitter/X posting and automation actions. The abuse risk depends on account permissions, so confidence is high but not absolute."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.72,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The inline command asks the user to install another skill through npx. It is not Ruby execution, but it is a real external package and skill installation supply-chain risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":56,"line_start":38}],"confidence":0.72,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This command block invokes the belt CLI to call remote AI apps, including a Twitter posting app. These are intended commands, but they can trigger external service actions from the agent."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":87,"line_start":86}],"confidence":0.68,"description":"| Run app | `belt app run google/veo-3-1-fast --input input.json` |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The command runs a remote app using an input file. This is core functionality, but it can transmit file contents or prompts to an external service."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":88,"line_start":87}],"confidence":0.67,"description":"| Run without waiting | `belt app run <app> --input input.json --no-wait` |","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The command submits remote work without waiting for completion. It is intended usage, but it can start external processing before the user reviews the full result path."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":130,"line_start":104}],"confidence":0.76,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The block contains multiple npx skills add commands for additional skills. Installing more skills from remote sources expands supply-chain and permission risk."},{"title":"Hidden file access","locations":[{"file":"SKILL.md","line_end":33,"line_start":33}],"confidence":0.76,"description":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The command writes into ~/.local/bin during manual installation. It is user-visible, but it still modifies a hidden home path with an executable artifact."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":27,"line_start":27}],"confidence":0.78,"description":"> curl -LO https://dist.inference.sh/cli/checksums.txt","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The command downloads checksum data from an external host as part of manual installation. This is expected but still creates a trust dependency on the remote distribution endpoint."}],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command explicitly pipes a remote HTTPS response into sh. That pattern can execute arbitrary remote code during installation and should be blocked until replaced."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall command repeats the pipe-to-shell pattern. Re-running a mutable remote script without inspection or pinning is a critical supply-chain risk."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command executes a remote script through sh without prior review. This is a direct pipe-to-shell pattern and a critical installer risk."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill prominently instructs curl -fsSL https://cli.inference.sh | sh. Directly executing a mutable remote installer is a critical publish-blocking pattern."}],"files_scanned":5,"total_lines":608,"audit_model":"codex","audited_at":"2026-07-09T11:37:14.484+00:00","created_at":"2026-07-09T23:55:48.862503+00:00","static_findings":[{"id":"network:references/authentication.md:6:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:references/authentication.md:44:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"export INFSH_API_KEY=your-api-key","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"| \"API key invalid\" | Check `INFSH_API_KEY` or re-login |","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":44,"severity":"critical","line_start":44},{"id":"network:references/cli-reference.md:6:hardcoded-url","file":"references/cli-reference.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","file":"references/cli-reference.md","pattern":"Hidden file in home directory","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","file":"references/cli-reference.md","pattern":"Hidden file access","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"medium","line_start":91},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","file":"references/cli-reference.md","pattern":"Generic API/secret keys","snippet":"| `INFSH_API_KEY` | API key (overrides config) |","category":"env_access","line_end":79,"severity":"high","line_start":79},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","file":"references/cli-reference.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"network:references/running-apps.md:152:hardcoded-url","file":"references/running-apps.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://cloud.inference.sh/...\",","category":"network","line_end":152,"severity":"low","line_start":152},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","file":"references/running-apps.md","pattern":"Path traversal sequence","snippet":"- Relative paths: `./image.png`, `../data/video.mp4`","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","file":"references/running-apps.md","pattern":"System reconnaissance","snippet":"| \"invalid input\" | Schema mismatch | Check `belt app get` for required fields |","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"external_commands","line_end":25,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Browse the app store | `belt app store` |","category":"external_commands","line_end":81,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Search the store | `belt app store search \"flux\"` |","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Filter by category | `belt app store --category image` |","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| List your apps | `belt app list` |","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Get app details | `belt app get google/veo-3-1-fast` |","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |","category":"external_commands","line_end":86,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run app | `belt app run google/veo-3-1-fast --input input.json` |","category":"external_commands","line_end":87,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run without waiting | `belt app run <app> --input input.json --no-wait` |","category":"external_commands","line_end":88,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Check task status | `belt task get <task-id>` |","category":"external_commands","line_end":104,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:28:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"# [inference.sh](https://inference.sh)","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![[inference.sh](https://inference.sh)](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO https://dist.inference.sh/cli/checksums.txt","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:141:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Agent Skills Overview](https://inference.sh/blog/skills/skills-overview) - The open standard for ","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:SKILL.md:142:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Getting Started](https://inference.sh/docs/getting-started/introduction) - Introduction to infere","category":"network","line_end":142,"severity":"low","line_start":142},{"id":"network:SKILL.md:143:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [What is inference.sh?](https://inference.sh/docs/getting-started/what-is-inference) - Platform ov","category":"network","line_end":143,"severity":"low","line_start":143},{"id":"network:SKILL.md:144:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":144,"severity":"low","line_start":144},{"id":"network:SKILL.md:145:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CLI Setup](https://inference.sh/docs/extend/cli-setup) - Installing the CLI","category":"network","line_end":145,"severity":"low","line_start":145},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Workflows vs Agents](https://inference.sh/blog/concepts/workflows-vs-agents) - When to use each","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:147:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Why Agent Runtimes Matter](https://inference.sh/blog/agent-runtime/why-runtimes-matter) - Runtime","category":"network","line_end":147,"severity":"low","line_start":147},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:33:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":18,"severity":"critical","line_start":18}],"finding_verdicts":[{"id":"network:references/authentication.md:6:hardcoded-url","reason":"The URL is used in an installer command that downloads a remote script and pipes it to sh. This creates a remote code execution supply-chain risk if the endpoint or transport is compromised.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"network:references/authentication.md:44:hardcoded-url","reason":"The reinstall guidance repeats the same remote installer URL piped directly to sh. The network dependency is security-relevant because the fetched script executes immediately.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","reason":"The line uses the placeholder value your-api-key to document configuration. I found no hardcoded secret or instruction to exfiltrate the API key.","verdict":"false_positive","confidence":0.93},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","reason":"This is troubleshooting text that mentions INFSH_API_KEY by name. It does not read, print, store, or transmit a secret.","verdict":"false_positive","confidence":0.91},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","reason":"The command explicitly pipes a remote HTTPS response into sh. That pattern can execute arbitrary remote code during installation and should be blocked until replaced.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","reason":"The reinstall command repeats the pipe-to-shell pattern. Re-running a mutable remote script without inspection or pinning is a critical supply-chain risk.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"network:references/cli-reference.md:6:hardcoded-url","reason":"The hardcoded URL is part of an install command that downloads and executes a remote script. The URL is not just documentation because the command is intended to be run.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","reason":"The command writes a fish shell completion file under ~/.config, which is a standard user configuration path. It does not show persistence, credential access, or hidden data collection.","verdict":"false_positive","confidence":0.85},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","reason":"The hidden path is used for shell completions and is explicitly documented for the user. I found no evidence that the skill reads or modifies hidden files without consent.","verdict":"false_positive","confidence":0.85},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","reason":"The line documents the INFSH_API_KEY environment variable. It does not contain an actual key value or instruct the agent to expose it.","verdict":"false_positive","confidence":0.92},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","reason":"The installation command executes a remote script through sh without prior review. This is a direct pipe-to-shell pattern and a critical installer risk.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"network:references/running-apps.md:152:hardcoded-url","reason":"The URL appears inside an example output payload showing where generated files may be hosted. It is not an instruction to fetch or execute remote content.","verdict":"false_positive","confidence":0.88},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","reason":"The documentation says parent-relative paths are accepted for local file uploads. That can cause unintended upload of files outside the working directory if an agent uses an unsafe path.","verdict":"confirmed","severity":"high","confidence":0.74},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","reason":"The line advises checking app requirements after a schema mismatch. It does not gather host, network, process, or system identity information.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The inline command asks the user to install another skill through npx. It is not Ruby execution, but it is a real external package and skill installation supply-chain risk.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The fenced command block contains curl piped to sh followed by login. The markdown label is noisy, but the command block includes a critical remote script execution instruction.","verdict":"confirmed","severity":"critical","confidence":0.96},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The cited line is the closing markdown fence around the install example. The actual risky installer command is covered by the adjacent pipe-to-shell findings.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This line explains what the installer claims to do and links to documentation. It is not itself executable code or a command injection pattern.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The manual install block includes shell commands that download binaries and place an executable in the user PATH. It also uses dynamic command substitution to choose the download URL.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The cited line is the end of a markdown code block, not a command. The risky commands in the manual install block are adjudicated separately.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This command block invokes the belt CLI to call remote AI apps, including a Twitter posting app. These are intended commands, but they can trigger external service actions from the agent.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The cited line is only a markdown code fence closing the quick examples. It does not contain executable content itself.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The local file upload examples send local images, audio, and media paths to remote inference.sh apps. This is expected behavior, but it creates a real data exposure risk without explicit consent.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The cited line is the closing markdown fence for the local upload examples. The file upload behavior itself is covered by the preceding command-block finding.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The command only browses the app store. It is normal CLI usage and does not execute user-controlled shell content or modify the system.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The command searches the app store with a quoted query. It is benign discovery behavior with no command injection or system modification shown.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The command filters public app store listings by category. This is low-risk read-only CLI usage.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The command lists apps associated with the authenticated account. It is expected functionality and does not show shell injection or unauthorized access.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The command fetches details for a named public app. It is read-only app metadata lookup and not dangerous command execution.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The command saves a generated sample input file. This is an explicit local output action and does not indicate malicious filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The command runs a remote app using an input file. This is core functionality, but it can transmit file contents or prompts to an external service.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The command submits remote work without waiting for completion. It is intended usage, but it can start external processing before the user reviews the full result path.","verdict":"confirmed","severity":"medium","confidence":0.67},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The command checks a task status by task ID. It is read-only result tracking and does not by itself create a security issue.","verdict":"false_positive","confidence":0.84},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The block contains multiple npx skills add commands for additional skills. Installing more skills from remote sources expands supply-chain and permission risk.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"external_commands:SKILL.md:28:shell-command-substitution","reason":"The command substitutes the result of a remote manifest request into a download command. A changed manifest or parsing issue can cause an unintended binary to be downloaded.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","reason":"The manual install block includes command substitution that derives a binary URL from remote content. This is a risky installation pattern even though checksum verification is later suggested.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"network:SKILL.md:9:hardcoded-url","reason":"The URL is a documentation link in the markdown heading. It does not fetch, execute, or transmit data in the skill instructions.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is a remote image used in the markdown document. I found no instruction to execute content from that URL.","verdict":"false_positive","confidence":0.84},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The URL is used in a curl command whose output is piped directly to sh. That makes the hardcoded endpoint part of a remote code execution installer path.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The line links to the install script while describing expected installer behavior. The direct execution risk is already captured at the actual curl pipe-to-shell command.","verdict":"false_positive","confidence":0.8},{"id":"network:SKILL.md:27:hardcoded-url","reason":"The command downloads checksum data from an external host as part of manual installation. This is expected but still creates a trust dependency on the remote distribution endpoint.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The command fetches a remote manifest and uses its parsed URL to download a binary. This network dependency directly controls which executable is installed.","verdict":"confirmed","severity":"high","confidence":0.87},{"id":"network:SKILL.md:141:hardcoded-url","reason":"The URL is a documentation link to an overview article. It is not part of an executable command path.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:142:hardcoded-url","reason":"The URL is a documentation link for getting started. It does not instruct the agent to download or run remote content.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:143:hardcoded-url","reason":"The URL is a documentation link explaining the platform. It is safe reference material, not a command.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:144:hardcoded-url","reason":"The URL is a documentation link for apps. It does not execute code or send local data.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:145:hardcoded-url","reason":"The URL points to CLI setup documentation. The link itself is not executable, and the actual installer commands are covered separately.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:146:hardcoded-url","reason":"The URL is a blog documentation link. It does not trigger a network request beyond normal document navigation.","verdict":"false_positive","confidence":0.9},{"id":"network:SKILL.md:147:hardcoded-url","reason":"The URL is a documentation link about runtimes. It is not tied to downloading, execution, or data transfer.","verdict":"false_positive","confidence":0.9},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","reason":"The command moves a downloaded binary into ~/.local/bin, a hidden home-directory path commonly in PATH. That is a legitimate install location, but it installs an executable for future use.","verdict":"confirmed","severity":"high","confidence":0.79},{"id":"filesystem:SKILL.md:33:hidden-file-access","reason":"The command writes into ~/.local/bin during manual installation. It is user-visible, but it still modifies a hidden home path with an executable artifact.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","reason":"The skill prominently instructs curl -fsSL https://cli.inference.sh | sh. Directly executing a mutable remote installer is a critical publish-blocking pattern.","verdict":"confirmed","severity":"critical","confidence":0.99}],"semantic_findings":[{"title":"Automatic Local File Upload Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":74,"line_start":58},{"file":"references/running-apps.md","line_end":37,"line_start":21}],"confidence":0.9,"description":"The skill states that local files are automatically uploaded when a path is provided, including images, audio, and media examples. An agent could expose sensitive local files if it follows these instructions without explicit user approval.","confidence_reasoning":"The documentation explicitly describes automatic local file uploads and gives multiple local path examples. This is an intentional capability with a clear data exposure risk."},{"title":"Social Media Automation Capability","severity":"high","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":121,"line_start":120}],"confidence":0.86,"description":"The skill includes commands and related skills for posting to Twitter/X, sending DMs, following users, liking posts, and retweeting. These capabilities can enable spam, account abuse, or unauthorized public actions if used without explicit account-owner consent.","confidence_reasoning":"The cited lines directly list Twitter/X posting and automation actions. The abuse risk depends on account permissions, so confidence is high but not absolute."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":6,"capabilityReviewCount":19,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}