{"data":{"skill":{"slug":"101-skills-infsh-cli","name":"infsh-cli","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/tools/infsh-cli/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"f152e144-0ebc-4f2c-b766-b2d89b492114","skill_id":"ad76e264-c244-4df4-bc02-c52537f288c1","version":5,"content_hash":"v3:d71c7417a35d5c2624161bd2fe8de8a41a362128:64e0a2da6037f2d29868cd7be38ab192ce848d32bad403776b430c50bcac0de9:e5d60be87d2859c521a2de6e7f9f01c6598452fb1a4a89d097315ed4154de378:736b696c6c732f3130312d736b696c6c732f696e6673682d636c69:c0e3527cd422b404edb96361bdc43c51","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"Most static alerts are false positives caused by Markdown code formatting, example paths, environment variable documentation, and expected vendor links. The pipe-to-shell installer and unquoted remote-manifest command substitution are confirmed risks. Automatic local-file uploads and social account actions also require explicit user awareness and approval.","remediation":[{"issue":"The installation guidance pipes a remote script directly into a shell.","severity":"critical","suggestion":"Make a version-pinned manual download the default, verify its checksum and signature, then execute the inspected artifact."},{"issue":"The manual installer derives a download argument from an unquoted remote manifest.","severity":"medium","suggestion":"Parse the manifest with a structured parser, validate the selected HTTPS URL, quote it, and pin an expected release."},{"issue":"Local paths are uploaded automatically to a cloud service.","severity":"medium","suggestion":"Require explicit confirmation before each upload and show the local path, destination service, and data retention implications."},{"issue":"Commands can publish content or perform actions on a connected social account.","severity":"high","suggestion":"Require explicit confirmation immediately before every post, direct message, follow, like, or repost action."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/authentication.md","line_end":6,"line_start":6},{"file":"references/authentication.md","line_end":44,"line_start":44},{"file":"references/cli-reference.md","line_end":6,"line_start":6},{"file":"references/running-apps.md","line_end":152,"line_start":152},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":142,"line_start":142},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":147,"line_start":147}]},{"factor":"env_access","evidence":[{"file":"references/authentication.md","line_end":30,"line_start":30},{"file":"references/authentication.md","line_end":53,"line_start":53},{"file":"references/cli-reference.md","line_end":79,"line_start":79}]},{"factor":"filesystem","evidence":[{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/running-apps.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":22,"line_start":20},{"file":"SKILL.md","line_end":25,"line_start":22},{"file":"SKILL.md","line_end":34,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":56,"line_start":38},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":74,"line_start":62},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":87,"line_start":86},{"file":"SKILL.md","line_end":88,"line_start":87},{"file":"SKILL.md","line_end":104,"line_start":88},{"file":"SKILL.md","line_end":130,"line_start":104},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":34,"line_start":25}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command executes remotely fetched content without giving the user an inspection or pinning step. A compromised endpoint could immediately run arbitrary shell commands."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall instruction again executes a mutable remote script directly in the shell. Transport security does not protect against a compromised publisher or distribution endpoint."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The documented command directly executes the response from a remote endpoint. Endpoint or supply-chain compromise would provide immediate shell execution."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary installation path downloads a mutable remote script and immediately executes it. A compromised service or release pipeline could run arbitrary commands in the user's account."}],"high_findings":[{"title":"Consequential Social Account Actions Lack Confirmation Guidance","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":99,"line_start":99}],"confidence":0.96,"description":"The skill can post content and advertises direct messages, follows, likes, and reposts. It does not require confirmation before these externally visible account actions.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The command example explicitly posts to Twitter, and the capability table lists other account-changing operations without an approval safeguard."}],"medium_findings":[{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.94,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The manual install command places unquoted output derived from a remote manifest into curl arguments. Malformed or compromised manifest content could alter the requested arguments despite the later checksum step."},{"title":"Automatic Local File Upload","locations":[{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"references/running-apps.md","line_end":22,"line_start":22}],"confidence":0.99,"description":"Supplying a local path causes the CLI to upload that file to inference.sh automatically. Sensitive files could leave the machine without a separate upload confirmation.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Both files explicitly state that local file paths are automatically uploaded instead of treated as URLs."}],"low_findings":[],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The installation command executes remotely fetched content without giving the user an inspection or pinning step. A compromised endpoint could immediately run arbitrary shell commands."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The reinstall instruction again executes a mutable remote script directly in the shell. Transport security does not protect against a compromised publisher or distribution endpoint."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The documented command directly executes the response from a remote endpoint. Endpoint or supply-chain compromise would provide immediate shell execution."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary installation path downloads a mutable remote script and immediately executes it. A compromised service or release pipeline could run arbitrary commands in the user's account."}],"files_scanned":5,"total_lines":608,"audit_model":"codex","audited_at":"2026-07-12T10:06:03.275+00:00","created_at":"2026-07-14T15:53:51.377759+00:00","static_findings":[{"id":"network:references/authentication.md:6:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:references/authentication.md:44:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"export INFSH_API_KEY=your-api-key","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"| \"API key invalid\" | Check `INFSH_API_KEY` or re-login |","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":44,"severity":"critical","line_start":44},{"id":"network:references/cli-reference.md:6:hardcoded-url","file":"references/cli-reference.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","file":"references/cli-reference.md","pattern":"Hidden file in home directory","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","file":"references/cli-reference.md","pattern":"Hidden file access","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"medium","line_start":91},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","file":"references/cli-reference.md","pattern":"Generic API/secret keys","snippet":"| `INFSH_API_KEY` | API key (overrides config) |","category":"env_access","line_end":79,"severity":"high","line_start":79},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","file":"references/cli-reference.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"network:references/running-apps.md:152:hardcoded-url","file":"references/running-apps.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://cloud.inference.sh/...\",","category":"network","line_end":152,"severity":"low","line_start":152},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","file":"references/running-apps.md","pattern":"Path traversal sequence","snippet":"- Relative paths: `./image.png`, `../data/video.mp4`","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","file":"references/running-apps.md","pattern":"System reconnaissance","snippet":"| \"invalid input\" | Schema mismatch | Check `belt app get` for required fields |","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"external_commands","line_end":25,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Browse the app store | `belt app store` |","category":"external_commands","line_end":81,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Search the store | `belt app store search \"flux\"` |","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Filter by category | `belt app store --category image` |","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| List your apps | `belt app list` |","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Get app details | `belt app get google/veo-3-1-fast` |","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |","category":"external_commands","line_end":86,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run app | `belt app run google/veo-3-1-fast --input input.json` |","category":"external_commands","line_end":87,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run without waiting | `belt app run <app> --input input.json --no-wait` |","category":"external_commands","line_end":88,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Check task status | `belt task get <task-id>` |","category":"external_commands","line_end":104,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:28:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"# [inference.sh](https://inference.sh)","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![[inference.sh](https://inference.sh)](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO https://dist.inference.sh/cli/checksums.txt","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:141:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Agent Skills Overview](https://inference.sh/blog/skills/skills-overview) - The open standard for ","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:SKILL.md:142:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Getting Started](https://inference.sh/docs/getting-started/introduction) - Introduction to infere","category":"network","line_end":142,"severity":"low","line_start":142},{"id":"network:SKILL.md:143:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [What is inference.sh?](https://inference.sh/docs/getting-started/what-is-inference) - Platform ov","category":"network","line_end":143,"severity":"low","line_start":143},{"id":"network:SKILL.md:144:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":144,"severity":"low","line_start":144},{"id":"network:SKILL.md:145:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CLI Setup](https://inference.sh/docs/extend/cli-setup) - Installing the CLI","category":"network","line_end":145,"severity":"low","line_start":145},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Workflows vs Agents](https://inference.sh/blog/concepts/workflows-vs-agents) - When to use each","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:147:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Why Agent Runtimes Matter](https://inference.sh/blog/agent-runtime/why-runtimes-matter) - Runtime","category":"network","line_end":147,"severity":"low","line_start":147},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:33:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":18,"severity":"critical","line_start":18}],"finding_verdicts":[{"id":"network:references/authentication.md:6:hardcoded-url","reason":"This is the documented HTTPS endpoint for the inference.sh installer. The URL itself is expected; the separate pipe-to-shell finding captures the execution risk.","verdict":"false_positive","confidence":0.98},{"id":"network:references/authentication.md:44:hardcoded-url","reason":"This repeated HTTPS vendor URL appears in reinstall documentation. The URL is not evidence of an unauthorized network destination.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","reason":"The line documents a placeholder value for the expected INFSH_API_KEY environment variable. It neither contains nor reads a real secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","reason":"This troubleshooting text only names the documented API key variable. It does not access, expose, or transmit the variable.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","reason":"The installation command executes remotely fetched content without giving the user an inspection or pinning step. A compromised endpoint could immediately run arbitrary shell commands.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","reason":"The reinstall instruction again executes a mutable remote script directly in the shell. Transport security does not protect against a compromised publisher or distribution endpoint.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/cli-reference.md:6:hardcoded-url","reason":"The hardcoded destination is the skill vendor's documented installer endpoint. Its execution method is evaluated separately as a confirmed pipe-to-shell risk.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","reason":"The command writes generated Fish completions to the standard user configuration directory. It does not conceal a payload or access unrelated private data.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","reason":"Writing a shell completion file under ~/.config/fish is an expected setup operation initiated by the user. The destination is explicit and narrowly scoped.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","reason":"This is a reference-table entry documenting INFSH_API_KEY. No credential value is embedded, read, logged, or sent by the Markdown.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","reason":"The documented command directly executes the response from a remote endpoint. Endpoint or supply-chain compromise would provide immediate shell execution.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/running-apps.md:152:hardcoded-url","reason":"The URL is an abbreviated example of a normal inference.sh result location. It is not executable and does not identify an unexpected recipient.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","reason":"The parent-directory sequence is a documented example of a user-selected relative media path. It is not used to escape a server-side path boundary.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","reason":"The line recommends viewing an app's required input fields after a schema error. It performs no host, process, account, or network reconnaissance.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around a displayed npx command, not Ruby execution syntax. The skill does not automatically execute this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The detected text is the opening marker for a Markdown Bash example. It is not a shell backtick operator or executable statement.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The detected text is a closing Markdown code fence. It has no runtime behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This line is explanatory prose with Markdown links and an inline hostname. It contains no Ruby or shell execution operator.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The snippet is a quoted Markdown code-fence marker. It does not execute the commands shown inside the documentation block.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The snippet closes a quoted Markdown code block. It is formatting rather than shell or Ruby execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The detected backticks form a Markdown Bash fence for examples. They are not evaluated as command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This is the closing fence for a Markdown example block. It has no executable semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"This line opens a Markdown Bash block containing documented belt examples. The fence itself is not executable.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"This line is a Markdown closing fence, not a backtick execution construct.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The backticks format a belt command inside a reference table. The text is documentation and does not invoke a subprocess.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This is an inline Markdown example for searching the public app store. It is not Ruby backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The command is inert reference text showing a category filter. Markdown backticks do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The line displays a belt listing command in a Markdown table. It does not execute through Ruby or a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The backticks only format an app-details command as inline code. No command substitution or automatic execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"This is a documented command for creating a sample input file. The Markdown parser does not execute inline code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The line presents a belt app invocation as reference text. It contains no Ruby execution construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"This inline command documents asynchronous execution. Its angle-bracket placeholder and Markdown backticks are not evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The snippet is an inline task-status example in a Markdown table. It is not an executable backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The detected text opens a Markdown Bash block listing optional skill-install commands. The code fence itself has no runtime behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:shell-command-substitution","reason":"The manual install command places unquoted output derived from a remote manifest into curl arguments. Malformed or compromised manifest content could alter the requested arguments despite the later checksum step.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","reason":"The finding begins at a quoted Markdown code fence and does not identify a template literal. The actual shell substitution on line 28 has a separate confirmed verdict.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:9:hardcoded-url","reason":"This is the skill heading linked to the product's HTTPS website. It is expected documentation, not an unauthorized network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL references a hosted product image used in the documentation. It does not transmit user data or execute content.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The destination is the documented inference.sh installer endpoint. The dangerous pipe-to-shell behavior is captured by its separate blocker finding.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The line links to the installer and Sigstore documentation while explaining installation. These are expected HTTPS documentation links.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:27:hardcoded-url","reason":"The URL explicitly downloads the vendor's checksum file for manual verification. That expected network access is disclosed and narrowly scoped.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The hardcoded HTTPS URL is the documented vendor manifest. The unsafe handling of its response is covered by the confirmed command-substitution finding.","verdict":"false_positive","confidence":0.96},{"id":"network:SKILL.md:141:hardcoded-url","reason":"This is a normal link to the vendor's Agent Skills overview documentation. It is not a programmatic request.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:142:hardcoded-url","reason":"This is a normal link to the vendor's getting-started documentation. It has no hidden destination or execution behavior.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:143:hardcoded-url","reason":"This HTTPS link points to the product overview named by the surrounding text. It is expected reference material.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:144:hardcoded-url","reason":"This is a disclosed documentation link for the app ecosystem. It does not initiate a request by itself.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:145:hardcoded-url","reason":"This is a standard link to CLI setup documentation on the named vendor domain. No user data is attached.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:146:hardcoded-url","reason":"This disclosed HTTPS URL links to a vendor article about workflows and agents. It is inert Markdown reference content.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:147:hardcoded-url","reason":"This is a named vendor documentation link about agent runtimes. It does not indicate covert communication.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","reason":"The manual installation command places a disclosed CLI binary in the conventional user-local executable directory. It is not hidden persistence.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:33:hidden-file-access","reason":"Writing to ~/.local/bin is an explicit manual installation step scoped to the current user. The path does not expose unrelated hidden data.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","reason":"The primary installation path downloads a mutable remote script and immediately executes it. A compromised service or release pipeline could run arbitrary commands in the user's account.","verdict":"confirmed","severity":"critical","confidence":0.99}],"semantic_findings":[{"title":"Automatic Local File Upload","severity":"medium","locations":[{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"references/running-apps.md","line_end":22,"line_start":22}],"confidence":0.99,"description":"Supplying a local path causes the CLI to upload that file to inference.sh automatically. Sensitive files could leave the machine without a separate upload confirmation.","confidence_reasoning":"Both files explicitly state that local file paths are automatically uploaded instead of treated as URLs."},{"title":"Consequential Social Account Actions Lack Confirmation Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":99,"line_start":99}],"confidence":0.96,"description":"The skill can post content and advertises direct messages, follows, likes, and reposts. It does not require confirmation before these externally visible account actions.","confidence_reasoning":"The command example explicitly posts to Twitter, and the capability table lists other account-changing operations without an approval safeguard."}],"subject_marketplace_commit_sha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","subject_content_hash":"64e0a2da6037f2d29868cd7be38ab192ce848d32bad403776b430c50bcac0de9","subject_tree_hash":"e5d60be87d2859c521a2de6e7f9f01c6598452fb1a4a89d097315ed4154de378","subject_plugin_path":"skills/101-skills/infsh-cli","audit_payload_hash":"c0e3527cd422b404edb96361bdc43c51","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","contentHash":"64e0a2da6037f2d29868cd7be38ab192ce848d32bad403776b430c50bcac0de9","treeHash":"e5d60be87d2859c521a2de6e7f9f01c6598452fb1a4a89d097315ed4154de378","pluginPath":"skills/101-skills/infsh-cli","auditPayloadHash":"c0e3527cd422b404edb96361bdc43c51"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":6,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}