{"data":{"skill":{"slug":"inferen-sh-infsh-cli","name":"infsh-cli","icon":"📦","repo":"https://github.com/inferen-sh/skills/tree/main/tools/infsh-cli/","status":"approved","author":"inferen-sh","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"9a6cc19d-5a97-46d8-a8af-2b37b7a9c634","skill_id":"16529155-55a9-4ef4-9b84-8ab1638aa447","version":5,"content_hash":"v3:4121de961d1b6f2ffca856260e239505c302452c:ff4055cc8c904f06098398690e3e356fda6cbe7d7ac97410c4afef0991cf1434:e3f0051c7782dc25693866f11341633162524ceeb361d5736c353ee26381e845:736b696c6c732f696e666572656e2d73682f696e6673682d636c69:d159fbc5318f9934f5b43c924dbdb952","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"The documentation contains repeated remote installer commands that pipe live content to a shell, plus an unsafe manifest-driven download command. It also enables local file uploads and public social media actions without explicit consent controls; most other alerts are Markdown or documentation false positives.","remediation":[{"issue":"Remote installer content is piped directly to sh.","severity":"critical","suggestion":"Replace every pipe-to-shell command with a version-pinned download, then verify a separately anchored checksum and Sigstore signature before execution."},{"issue":"The manual download parses a remote manifest with grep and unquoted command substitution.","severity":"high","suggestion":"Use a structured JSON parser, validate the selected HTTPS URL, quote every expansion, pin a release version, and verify before installation."},{"issue":"Local paths are uploaded without an explicit consent or sensitivity step.","severity":"high","suggestion":"Require confirmation before each upload, display the resolved path and destination, and restrict uploads to user-approved directories."},{"issue":"Social media commands can publish content without a required confirmation.","severity":"high","suggestion":"Generate a preview and require explicit user approval immediately before any post, direct message, follow, like, or repost action."},{"issue":"The related belt CLI skill installation is unpinned.","severity":"medium","suggestion":"Make the dependency optional, pin it to an immutable audited revision, and explain that it expands the security review boundary."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"references/authentication.md","line_end":6,"line_start":6},{"file":"references/authentication.md","line_end":44,"line_start":44},{"file":"references/cli-reference.md","line_end":6,"line_start":6},{"file":"references/running-apps.md","line_end":152,"line_start":152},{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":141,"line_start":141},{"file":"SKILL.md","line_end":142,"line_start":142},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":147,"line_start":147}]},{"factor":"env_access","evidence":[{"file":"references/authentication.md","line_end":30,"line_start":30},{"file":"references/authentication.md","line_end":53,"line_start":53},{"file":"references/cli-reference.md","line_end":79,"line_start":79}]},{"factor":"filesystem","evidence":[{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/cli-reference.md","line_end":91,"line_start":91},{"file":"references/running-apps.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":33,"line_start":33}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":20,"line_start":17},{"file":"SKILL.md","line_end":22,"line_start":20},{"file":"SKILL.md","line_end":25,"line_start":22},{"file":"SKILL.md","line_end":34,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":34},{"file":"SKILL.md","line_end":56,"line_start":38},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":74,"line_start":62},{"file":"SKILL.md","line_end":80,"line_start":74},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":82,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":84,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":84},{"file":"SKILL.md","line_end":86,"line_start":85},{"file":"SKILL.md","line_end":87,"line_start":86},{"file":"SKILL.md","line_end":88,"line_start":87},{"file":"SKILL.md","line_end":104,"line_start":88},{"file":"SKILL.md","line_end":130,"line_start":104},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":34,"line_start":25}]}],"critical_findings":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command pipes an uninspected network response directly into sh. A compromised server, DNS path, or changed installer can execute arbitrary commands."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The update guidance again executes remote shell content without local inspection or pinning. This is a direct remote code execution supply-chain pattern."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The documented installation command executes a live remote response through sh. There is no opportunity to verify the retrieved script before execution."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary setup flow executes downloaded shell text without review, version pinning, or prior signature verification. This can yield arbitrary local code execution."}],"high_findings":[{"title":"Automatic Local File Upload Can Expose Sensitive Data","locations":[{"file":"SKILL.md","line_end":74,"line_start":58},{"file":"references/running-apps.md","line_end":42,"line_start":21}],"confidence":0.97,"description":"The CLI automatically uploads any supplied local path to the hosted service. The skill provides no path allowlist, sensitivity check, or explicit upload confirmation.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Both files explicitly state that local paths are uploaded and show absolute, relative, and home-directory inputs. The missing consent and scope controls are visible in the reviewed guidance."},{"title":"Public Social Media Actions Lack Confirmation Controls","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":73,"line_start":72}],"confidence":0.95,"description":"The examples can publish posts and media to Twitter or X, but the skill does not require a preview or user confirmation before consequential account changes.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The cited commands explicitly post text and media to an external account. No confirmation requirement appears around either example."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.91,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Although the backticks are Markdown, the documented npx command installs a separate unpinned community skill. Executing it expands the trust boundary beyond the reviewed files."},{"title":"Shell command substitution","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.94,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The unquoted substitution derives curl arguments from a remote manifest through fragile text parsing. A changed or compromised manifest can redirect the binary download or inject curl options through word splitting."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL supplies a remote installer whose response is executed immediately. HTTPS does not protect against a compromised origin or unsafe installer update."},{"title":"Hardcoded URL","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The reinstall command retrieves executable shell content from the fixed remote endpoint. This creates a genuine network supply-chain dependency."},{"title":"Hardcoded URL","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The hardcoded endpoint is used to fetch an installer that is executed immediately. The network dependency is security relevant even though it is the documented vendor domain."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.98,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The URL is an active installer endpoint whose response is piped to a shell. Trust in this endpoint directly controls local code execution."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":27,"line_start":27}],"confidence":0.88,"description":"> curl -LO https://dist.inference.sh/cli/checksums.txt","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The command downloads checksums used to trust an executable from the same vendor origin. Origin compromise can therefore replace both the binary and its checksum."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.94,"description":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The remote manifest determines which executable archive curl downloads. The URL is not pinned, and its output is consumed through unquoted command substitution."}],"dangerous_patterns":[{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The command pipes an uninspected network response directly into sh. A compromised server, DNS path, or changed installer can execute arbitrary commands."},{"title":"Pipe to shell pattern","locations":[{"file":"references/authentication.md","line_end":44,"line_start":44}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The update guidance again executes remote shell content without local inspection or pinning. This is a direct remote code execution supply-chain pattern."},{"title":"Pipe to shell pattern","locations":[{"file":"references/cli-reference.md","line_end":6,"line_start":6}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The documented installation command executes a live remote response through sh. There is no opportunity to verify the retrieved script before execution."},{"title":"Pipe to shell pattern","locations":[{"file":"SKILL.md","line_end":18,"line_start":18}],"confidence":0.99,"description":"curl -fsSL https://cli.inference.sh | sh","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The primary setup flow executes downloaded shell text without review, version pinning, or prior signature verification. This can yield arbitrary local code execution."}],"files_scanned":5,"total_lines":608,"audit_model":"codex","audited_at":"2026-08-06T10:31:07.13+00:00","created_at":"2026-08-07T03:05:01.659179+00:00","static_findings":[{"id":"network:references/authentication.md:6:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"network:references/authentication.md:44:hardcoded-url","file":"references/authentication.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"export INFSH_API_KEY=your-api-key","category":"env_access","line_end":30,"severity":"high","line_start":30},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","file":"references/authentication.md","pattern":"Generic API/secret keys","snippet":"| \"API key invalid\" | Check `INFSH_API_KEY` or re-login |","category":"env_access","line_end":53,"severity":"high","line_start":53},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","file":"references/authentication.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":44,"severity":"critical","line_start":44},{"id":"network:references/cli-reference.md:6:hardcoded-url","file":"references/cli-reference.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":6,"severity":"low","line_start":6},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","file":"references/cli-reference.md","pattern":"Hidden file in home directory","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"high","line_start":91},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","file":"references/cli-reference.md","pattern":"Hidden file access","snippet":"belt completion fish > ~/.config/fish/completions/infsh.fish","category":"filesystem","line_end":91,"severity":"medium","line_start":91},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","file":"references/cli-reference.md","pattern":"Generic API/secret keys","snippet":"| `INFSH_API_KEY` | API key (overrides config) |","category":"env_access","line_end":79,"severity":"high","line_start":79},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","file":"references/cli-reference.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":6,"severity":"critical","line_start":6},{"id":"network:references/running-apps.md:152:hardcoded-url","file":"references/running-apps.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://cloud.inference.sh/...\",","category":"network","line_end":152,"severity":"low","line_start":152},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","file":"references/running-apps.md","pattern":"Path traversal sequence","snippet":"- Relative paths: `./image.png`, `../data/video.mp4`","category":"filesystem","line_end":41,"severity":"high","line_start":41},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","file":"references/running-apps.md","pattern":"System reconnaissance","snippet":"| \"invalid input\" | Schema mismatch | Check `belt app get` for required fields |","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":20,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":22,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"external_commands","line_end":25,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ```","category":"external_commands","line_end":38,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":56,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":74,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Browse the app store | `belt app list` |","category":"external_commands","line_end":81,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Search the store | `belt app search \"flux\"` |","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Filter by category | `belt app list --category image` |","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| List your apps | `belt app list` |","category":"external_commands","line_end":84,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Get app details | `belt app get google/veo-3-1-fast` |","category":"external_commands","line_end":85,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |","category":"external_commands","line_end":86,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run app | `belt app run google/veo-3-1-fast --input input.json` |","category":"external_commands","line_end":87,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Run without waiting | `belt app run <app> --input input.json --no-wait` |","category":"external_commands","line_end":88,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Check task status | `belt task get <task-id>` |","category":"external_commands","line_end":104,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:28:shell-command-substitution","file":"SKILL.md","pattern":"Shell command substitution","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","file":"SKILL.md","pattern":"Template literal with command substitution","snippet":"> ```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":25},{"id":"network:SKILL.md:9:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"# [inference.sh](https://inference.sh)","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![[inference.sh](https://inference.sh)](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:18:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"network","line_end":18,"severity":"low","line_start":18},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:27:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO https://dist.inference.sh/cli/checksums.txt","category":"network","line_end":27,"severity":"low","line_start":27},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '\"url\":\"[^\"]*\"' | grep","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:141:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Agent Skills Overview](https://inference.sh/blog/skills/skills-overview) - The open standard for ","category":"network","line_end":141,"severity":"low","line_start":141},{"id":"network:SKILL.md:142:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Getting Started](https://inference.sh/docs/getting-started/introduction) - Introduction to infere","category":"network","line_end":142,"severity":"low","line_start":142},{"id":"network:SKILL.md:143:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [What is inference.sh?](https://inference.sh/docs/getting-started/what-is-inference) - Platform ov","category":"network","line_end":143,"severity":"low","line_start":143},{"id":"network:SKILL.md:144:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":144,"severity":"low","line_start":144},{"id":"network:SKILL.md:145:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [CLI Setup](https://inference.sh/docs/extend/cli-setup) - Installing the CLI","category":"network","line_end":145,"severity":"low","line_start":145},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Workflows vs Agents](https://inference.sh/blog/concepts/workflows-vs-agents) - When to use each","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:147:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Why Agent Runtimes Matter](https://inference.sh/blog/agent-runtime/why-runtimes-matter) - Runtime","category":"network","line_end":147,"severity":"low","line_start":147},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:SKILL.md:33:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"> mv inferencesh-cli-* ~/.local/bin/inferencesh","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","file":"SKILL.md","pattern":"Pipe to shell pattern","snippet":"curl -fsSL https://cli.inference.sh | sh","category":"blocker","line_end":18,"severity":"critical","line_start":18}],"finding_verdicts":[{"id":"network:references/authentication.md:6:hardcoded-url","reason":"The URL supplies a remote installer whose response is executed immediately. HTTPS does not protect against a compromised origin or unsafe installer update.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:references/authentication.md:44:hardcoded-url","reason":"The reinstall command retrieves executable shell content from the fixed remote endpoint. This creates a genuine network supply-chain dependency.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"env_access:references/authentication.md:30:generic-api-secret-keys","reason":"This is a placeholder export example using the literal value your-api-key. It neither reads nor exposes an actual credential.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/authentication.md:53:generic-api-secret-keys","reason":"The line is troubleshooting prose that names the expected environment variable. It performs no environment access or secret handling.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/authentication.md:6:pipe-to-shell-pattern","reason":"The command pipes an uninspected network response directly into sh. A compromised server, DNS path, or changed installer can execute arbitrary commands.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"blocker:references/authentication.md:44:pipe-to-shell-pattern","reason":"The update guidance again executes remote shell content without local inspection or pinning. This is a direct remote code execution supply-chain pattern.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/cli-reference.md:6:hardcoded-url","reason":"The hardcoded endpoint is used to fetch an installer that is executed immediately. The network dependency is security relevant even though it is the documented vendor domain.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"filesystem:references/cli-reference.md:91:hidden-file-in-home-directory","reason":"This redirects generated Fish completion text to Fish's standard per-user completion directory. The destination is explicit and expected for shell configuration.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:references/cli-reference.md:91:hidden-file-access","reason":"The command writes a named completion file under the documented Fish configuration path. It does not search, harvest, or modify unrelated hidden files.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/cli-reference.md:79:generic-api-secret-keys","reason":"This table documents an environment variable accepted by the CLI. It contains no credential value and performs no access.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/cli-reference.md:6:pipe-to-shell-pattern","reason":"The documented installation command executes a live remote response through sh. There is no opportunity to verify the retrieved script before execution.","verdict":"confirmed","severity":"critical","confidence":0.99},{"id":"network:references/running-apps.md:152:hardcoded-url","reason":"The URL is an abbreviated example of a returned media location. It is not a request destination used by executable logic.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/running-apps.md:41:path-traversal-sequence","reason":"The parent-directory path is a documentation example for a user-selected local input. No application path validation or traversal logic is implemented here.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/running-apps.md:163:system-reconnaissance","reason":"The line recommends reading an app's required input schema after a validation error. It does not enumerate host or network information.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Although the backticks are Markdown, the documented npx command installs a separate unpinned community skill. Executing it expands the trust boundary beyond the reviewed files.","verdict":"confirmed","severity":"medium","confidence":0.91},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The matched text is the opening marker of a fenced Bash example. It cannot execute by itself.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The matched text is a Markdown fence terminator. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"This is explanatory Markdown containing a link and inline names. No backtick execution construct is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The match begins at a quoted Markdown code fence. The fence itself is presentation syntax, not executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The matched backticks close a quoted Markdown code block. They do not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This is the opening fence for documented CLI examples. It contains no Ruby backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This line only closes a Markdown code block. It has no execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The matched token is a Bash code-fence marker in documentation. It is not evaluated as shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The match is a Markdown fence terminator following CLI examples. It cannot execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Inline backticks format a fixed belt command in a reference table. They are not Ruby command-execution delimiters.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The command is a documented app-search example wrapped in Markdown. No dynamic input is executed by the skill file.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"This is an inline, fixed CLI example for category filtering. Markdown backticks do not cause execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The line repeats a fixed belt listing command as formatted documentation. It is not an executable Ruby expression.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The fixed app-details command appears inside Markdown backticks. There is no command interpolation or automatic execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"This is a fixed sample-generation command in a documentation table. The backticks are formatting characters.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The line documents the skill's expected belt command using Markdown. It does not itself invoke a shell.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"Angle-bracket placeholders and Markdown backticks describe a command template. They are not executable interpolation.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The status command is formatted as inline documentation. No Ruby backtick or automatic command execution exists in the file.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"This is an opening Markdown fence for related installation examples. The fence is not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:28:shell-command-substitution","reason":"The unquoted substitution derives curl arguments from a remote manifest through fragile text parsing. A changed or compromised manifest can redirect the binary download or inject curl options through word splitting.","verdict":"confirmed","severity":"medium","confidence":0.94},{"id":"external_commands:SKILL.md:25:template-literal-with-command-substitution","reason":"The broad range begins with a Markdown code fence, not a programming-language template literal. The actual shell substitution on line 28 is adjudicated separately.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:9:hardcoded-url","reason":"This is the product homepage link in a Markdown heading. It is not an executable network request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"This is a Markdown image reference hosted on the product domain. It does not transmit local data or implement hidden network behavior.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:18:hardcoded-url","reason":"The URL is an active installer endpoint whose response is piped to a shell. Trust in this endpoint directly controls local code execution.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:22:hardcoded-url","reason":"This occurrence is a documentation link to the installer. The dangerous execution command is separately identified on line 18.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:27:hardcoded-url","reason":"The command downloads checksums used to trust an executable from the same vendor origin. Origin compromise can therefore replace both the binary and its checksum.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"network:SKILL.md:28:hardcoded-url","reason":"The remote manifest determines which executable archive curl downloads. The URL is not pinned, and its output is consumed through unquoted command substitution.","verdict":"confirmed","severity":"low","confidence":0.94},{"id":"network:SKILL.md:141:hardcoded-url","reason":"This is a normal documentation link to an overview article. It does not cause programmatic network access.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:142:hardcoded-url","reason":"This is a normal documentation link to the getting-started guide. It is not executable behavior.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:143:hardcoded-url","reason":"The URL is a product documentation reference. No request is performed by the skill content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:144:hardcoded-url","reason":"The URL points to public app documentation and appears only as a Markdown link. It is not a hidden network action.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:145:hardcoded-url","reason":"This is a user-facing link to CLI setup documentation. The link alone presents no executable network risk.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:146:hardcoded-url","reason":"This is a Markdown reference to a conceptual article. It contains no automated request or data transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:147:hardcoded-url","reason":"This is a normal documentation link and has no execution semantics. It does not expose local information.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:33:hidden-file-in-home-directory","reason":"The manual installation step places a named CLI binary in the conventional per-user executable directory. It does not conceal data or alter unrelated hidden files.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:SKILL.md:33:hidden-file-access","reason":"The destination is the explicit standard user binary path. This expected installation write is not secret-file access.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:18:pipe-to-shell-pattern","reason":"The primary setup flow executes downloaded shell text without review, version pinning, or prior signature verification. This can yield arbitrary local code execution.","verdict":"confirmed","severity":"critical","confidence":0.99}],"semantic_findings":[{"title":"Automatic Local File Upload Can Expose Sensitive Data","severity":"high","locations":[{"file":"SKILL.md","line_end":74,"line_start":58},{"file":"references/running-apps.md","line_end":42,"line_start":21}],"confidence":0.97,"description":"The CLI automatically uploads any supplied local path to the hosted service. The skill provides no path allowlist, sensitivity check, or explicit upload confirmation.","confidence_reasoning":"Both files explicitly state that local paths are uploaded and show absolute, relative, and home-directory inputs. The missing consent and scope controls are visible in the reviewed guidance."},{"title":"Public Social Media Actions Lack Confirmation Controls","severity":"high","locations":[{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":73,"line_start":72}],"confidence":0.95,"description":"The examples can publish posts and media to Twitter or X, but the skill does not require a preview or user confirmation before consequential account changes.","confidence_reasoning":"The cited commands explicitly post text and media to an external account. No confirmation requirement appears around either example."}],"subject_marketplace_commit_sha":"4121de961d1b6f2ffca856260e239505c302452c","subject_content_hash":"ff4055cc8c904f06098398690e3e356fda6cbe7d7ac97410c4afef0991cf1434","subject_tree_hash":"e3f0051c7782dc25693866f11341633162524ceeb361d5736c353ee26381e845","subject_plugin_path":"skills/inferen-sh/infsh-cli","audit_payload_hash":"d159fbc5318f9934f5b43c924dbdb952","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"4121de961d1b6f2ffca856260e239505c302452c","contentHash":"ff4055cc8c904f06098398690e3e356fda6cbe7d7ac97410c4afef0991cf1434","treeHash":"e3f0051c7782dc25693866f11341633162524ceeb361d5736c353ee26381e845","pluginPath":"skills/inferen-sh/infsh-cli","auditPayloadHash":"d159fbc5318f9934f5b43c924dbdb952"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/inferen-sh-infsh-cli/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":6,"capabilityReviewCount":8,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}