Audit History

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The installation command executes remotely fetched content without giving the user an inspection or pinning step. A compromised endpoint could immediately run arbitrary shell commands.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall instruction again executes a mutable remote script directly in the shell. Transport security does not protect against a compromised publisher or distribution endpoint.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The documented command directly executes the response from a remote endpoint. Endpoint or supply-chain compromise would provide immediate shell execution.

Critical

SKILL.md:51-52 SKILL.md:99

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The primary installation path downloads a mutable remote script and immediately executes it. A compromised service or release pipeline could run arbitrary commands in the user's account.

High

Consequential Social Account Actions Lack Confirmation Guidance

The skill can post content and advertises direct messages, follows, likes, and reposts. It does not require confirmation before these externally visible account actions.

The command example explicitly posts to Twitter, and the capability table lists other account-changing operations without an approval safeguard.

Medium

SKILL.md:60 references/running-apps.md:22

Automatic Local File Upload

Supplying a local path causes the CLI to upload that file to inference.sh automatically. Sensitive files could leave the machine without a separate upload confirmation.

Both files explicitly state that local file paths are automatically uploaded instead of treated as URLs.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 references/running-apps.md:152 SKILL.md:9 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:27 SKILL.md:28 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146 SKILL.md:147

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The manual install command places unquoted output derived from a remote manifest into curl arguments. Malformed or compromised manifest content could alter the requested arguments despite the later checksum step.

Risk Factors

🌐 Network access (17)

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (22)

Detected Patterns

Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern

Audited by: codex

Audit version 4

Jul 12, 2026, 10:06 AM

Files scanned

608

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The installation command executes remotely fetched content without giving the user an inspection or pinning step. A compromised endpoint could immediately run arbitrary shell commands.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall instruction again executes a mutable remote script directly in the shell. Transport security does not protect against a compromised publisher or distribution endpoint.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The documented command directly executes the response from a remote endpoint. Endpoint or supply-chain compromise would provide immediate shell execution.

Critical

SKILL.md:51-52 SKILL.md:99

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The primary installation path downloads a mutable remote script and immediately executes it. A compromised service or release pipeline could run arbitrary commands in the user's account.

High

Consequential Social Account Actions Lack Confirmation Guidance

The skill can post content and advertises direct messages, follows, likes, and reposts. It does not require confirmation before these externally visible account actions.

The command example explicitly posts to Twitter, and the capability table lists other account-changing operations without an approval safeguard.

Medium

SKILL.md:60 references/running-apps.md:22

Automatic Local File Upload

Supplying a local path causes the CLI to upload that file to inference.sh automatically. Sensitive files could leave the machine without a separate upload confirmation.

Both files explicitly state that local file paths are automatically uploaded instead of treated as URLs.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

Risk Factors

🌐 Network access (17)

🔑 Env variables (3)

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (22)

Detected Patterns

Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern

Audited by: codex

Audit version 3

Jul 8, 2026, 02:33 PM

Most static hits are Markdown examples or documentation links, not executable skill code. The confirmed risk is installer guidance that pipes a remote script into sh, plus one manual install command that derives a download URL through shell substitution. I found no prompt-injection text or covert data-exfiltration instructions in the reviewed files.

Files scanned

608

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The manual install command evaluates a subshell that fetches a remote manifest and selects a download URL. This is installation guidance, but remote-controlled download selection is a supply-chain risk.

Risk Factors

🌐 Network access (17)

🔑 Env variables (3)

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (22)

Detected Patterns

Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern

Audited by: codex

Audit version 2

Jul 9, 2026, 11:37 AM

The skill documents useful inference.sh CLI workflows, but it includes multiple remote installer patterns that pipe downloaded content to a shell or derive binary downloads from a remote manifest. Several markdown backtick findings are false positives, but the confirmed risks include unsafe installation guidance, local file upload exposure, executable installation into the user PATH, and social media automation capabilities.

Files scanned

608

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command explicitly pipes a remote HTTPS response into sh. That pattern can execute arbitrary remote code during installation and should be blocked until replaced.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall command repeats the pipe-to-shell pattern. Re-running a mutable remote script without inspection or pinning is a critical supply-chain risk.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The installation command executes a remote script through sh without prior review. This is a direct pipe-to-shell pattern and a critical installer risk.

Critical

SKILL.md:58-74 references/running-apps.md:21-37

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The skill prominently instructs curl -fsSL https://cli.inference.sh | sh. Directly executing a mutable remote installer is a critical publish-blocking pattern.

High

Automatic Local File Upload Guidance

The skill states that local files are automatically uploaded when a path is provided, including images, audio, and media examples. An agent could expose sensitive local files if it follows these instructions without explicit user approval.

The documentation explicitly describes automatic local file uploads and gives multiple local path examples. This is an intentional capability with a clear data exposure risk.

High

SKILL.md:51-52 SKILL.md:99 SKILL.md:120-121

Social Media Automation Capability

The skill includes commands and related skills for posting to Twitter/X, sending DMs, following users, liking posts, and retweeting. These capabilities can enable spam, account abuse, or unauthorized public actions if used without explicit account-owner consent.

The cited lines directly list Twitter/X posting and automation actions. The abuse risk depends on account permissions, so confidence is high but not absolute.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

SKILL.md:17-20

Ruby/shell backtick execution

```bash

The fenced command block contains curl piped to sh followed by login. The markdown label is noisy, but the command block includes a critical remote script execution instruction.

High

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 SKILL.md:18

Hardcoded URL · 4 occurrences

curl -fsSL https://cli.inference.sh | sh

The URL is used in an installer command that downloads a remote script and pipes it to sh. This creates a remote code execution supply-chain risk if the endpoint or transport is compromised.

High

references/running-apps.md:41

Path traversal sequence

- Relative paths: `./image.png`, `../data/video.mp4`

The documentation says parent-relative paths are accepted for local file uploads. That can cause unintended upload of files outside the working directory if an agent uses an unsafe path.

High

SKILL.md:25-34

Ruby/shell backtick execution

> ```bash

The manual install block includes shell commands that download binaries and place an executable in the user PATH. It also uses dynamic command substitution to choose the download URL.

High

SKILL.md:62-74

Ruby/shell backtick execution

```bash

The local file upload examples send local images, audio, and media paths to remote inference.sh apps. This is expected behavior, but it creates a real data exposure risk without explicit consent.

High

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command substitutes the result of a remote manifest request into a download command. A changed manifest or parsing issue can cause an unintended binary to be downloaded.

High

SKILL.md:25-34

Template literal with command substitution

> ```bash

The manual install block includes command substitution that derives a binary URL from remote content. This is a risky installation pattern even though checksum verification is later suggested.

High

SKILL.md:38-56 SKILL.md:104-130

Hardcoded URL

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command fetches a remote manifest and uses its parsed URL to download a binary. This network dependency directly controls which executable is installed.

High

SKILL.md:33

Hidden file in home directory

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The command moves a downloaded binary into ~/.local/bin, a hidden home-directory path commonly in PATH. That is a legitimate install location, but it installs an executable for future use.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The inline command asks the user to install another skill through npx. It is not Ruby execution, but it is a real external package and skill installation supply-chain risk.

Medium

Ruby/shell backtick execution · 2 occurrences

```bash

This command block invokes the belt CLI to call remote AI apps, including a Twitter posting app. These are intended commands, but they can trigger external service actions from the agent.

Medium

SKILL.md:86-87

Ruby/shell backtick execution

| Run app | `belt app run google/veo-3-1-fast --input input.json` |

The command runs a remote app using an input file. This is core functionality, but it can transmit file contents or prompts to an external service.

Medium

SKILL.md:87-88

Ruby/shell backtick execution

| Run without waiting | `belt app run <app> --input input.json --no-wait` |

The command submits remote work without waiting for completion. It is intended usage, but it can start external processing before the user reviews the full result path.

Medium

SKILL.md:33

Hidden file access

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The command writes into ~/.local/bin during manual installation. It is user-visible, but it still modifies a hidden home path with an executable artifact.

Low

SKILL.md:27

Hardcoded URL

> curl -LO https://dist.inference.sh/cli/checksums.txt

The command downloads checksum data from an external host as part of manual installation. This is expected but still creates a trust dependency on the remote distribution endpoint.

Risk Factors

🌐 Network access (17)

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (22)

Detected Patterns

Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern

Audited by: codex

Audit version 1

Jul 8, 2026, 02:33 PM

Files scanned

608

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Critical

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes remote HTTPS content directly to sh as an installation step. A compromised endpoint or installer would execute arbitrary code on the user system.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium