Versioned security assessment
Report ID: SA-CA1CF527
7/9/2026, 11:37:14 AM
infsh-cli security assessment v2
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- infsh-cli
- Version
- v2
- Maintainer
- 101-skills
- Coverage
- 5 Files scanned · 608 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
6 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill documents useful inference.sh CLI workflows, but it includes multiple remote installer patterns that pipe downloaded content to a shell or derive binary downloads from a remote manifest. Several markdown backtick findings are false positives, but the confirmed risks include unsafe installation guidance, local file upload exposure, executable installation into the user PATH, and social media automation capabilities.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 608 Lines analyzed
25 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 17 evidence locations
Filesystem access
May read or write local files.
Observed in 3 evidence locations
Env variables
May read values from the process environment.
Observed in 3 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 21 evidence locations
Capability review items (19)
Critical
Ruby/shell backtick execution
```bash
The fenced command block contains curl piped to sh followed by login. The markdown label is noisy, but the command block includes a critical remote script execution instruction.
High
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used in an installer command that downloads a remote script and pipes it to sh. This creates a remote code execution supply-chain risk if the endpoint or transport is compromised.
High
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The reinstall guidance repeats the same remote installer URL piped directly to sh. The network dependency is security-relevant because the fetched script executes immediately.
High
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The hardcoded URL is part of an install command that downloads and executes a remote script. The URL is not just documentation because the command is intended to be run.
High
Path traversal sequence
- Relative paths: `./image.png`, `../data/video.mp4`
The documentation says parent-relative paths are accepted for local file uploads. That can cause unintended upload of files outside the working directory if an agent uses an unsafe path.
High
Ruby/shell backtick execution
> ```bash
The manual install block includes shell commands that download binaries and place an executable in the user PATH. It also uses dynamic command substitution to choose the download URL.
High
Ruby/shell backtick execution
```bash
The local file upload examples send local images, audio, and media paths to remote inference.sh apps. This is expected behavior, but it creates a real data exposure risk without explicit consent.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command substitutes the result of a remote manifest request into a download command. A changed manifest or parsing issue can cause an unintended binary to be downloaded.
High
Template literal with command substitution
> ```bash
The manual install block includes command substitution that derives a binary URL from remote content. This is a risky installation pattern even though checksum verification is later suggested.
High
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used in a curl command whose output is piped directly to sh. That makes the hardcoded endpoint part of a remote code execution installer path.
High
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a remote manifest and uses its parsed URL to download a binary. This network dependency directly controls which executable is installed.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command moves a downloaded binary into ~/.local/bin, a hidden home-directory path commonly in PATH. That is a legitimate install location, but it installs an executable for future use.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline command asks the user to install another skill through npx. It is not Ruby execution, but it is a real external package and skill installation supply-chain risk.
Medium
Ruby/shell backtick execution
```bash
This command block invokes the belt CLI to call remote AI apps, including a Twitter posting app. These are intended commands, but they can trigger external service actions from the agent.
Medium
Ruby/shell backtick execution
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
The command runs a remote app using an input file. This is core functionality, but it can transmit file contents or prompts to an external service.
Medium
Ruby/shell backtick execution
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
The command submits remote work without waiting for completion. It is intended usage, but it can start external processing before the user reviews the full result path.
Medium
Ruby/shell backtick execution
```bash
The block contains multiple npx skills add commands for additional skills. Installing more skills from remote sources expands supply-chain and permission risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into ~/.local/bin during manual installation. It is user-visible, but it still modifies a hidden home path with an executable artifact.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksum data from an external host as part of manual installation. This is expected but still creates a trust dependency on the remote distribution endpoint.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (6)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command explicitly pipes a remote HTTPS response into sh. That pattern can execute arbitrary remote code during installation and should be blocked until replaced.
RISK-002 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command repeats the pipe-to-shell pattern. Re-running a mutable remote script without inspection or pinning is a critical supply-chain risk.
RISK-003 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command executes a remote script through sh without prior review. This is a direct pipe-to-shell pattern and a critical installer risk.
RISK-004 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The skill prominently instructs curl -fsSL https://cli.inference.sh | sh. Directly executing a mutable remote installer is a critical publish-blocking pattern.
RISK-005 High
Automatic Local File Upload Guidance
The skill states that local files are automatically uploaded when a path is provided, including images, audio, and media examples. An agent could expose sensitive local files if it follows these instructions without explicit user approval.
The documentation explicitly describes automatic local file uploads and gives multiple local path examples. This is an intentional capability with a clear data exposure risk.
RISK-006 High
Social Media Automation Capability
The skill includes commands and related skills for posting to Twitter/X, sending DMs, following users, liking posts, and retweeting. These capabilities can enable spam, account abuse, or unauthorized public actions if used without explicit account-owner consent.
The cited lines directly list Twitter/X posting and automation actions. The abuse risk depends on account permissions, so confidence is high but not absolute.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote installer is piped directly to sh in SKILL.md and reference files.Replace pipe-to-shell installation with version-pinned package manager instructions or a manual download flow that requires checksum and signature verification before execution.
- FIX-002HighManual installation uses command substitution based on a remote manifest.Provide explicit per-platform download links, fixed versions, checksums, and signature verification commands without parsing remote data into a shell command.
- FIX-003HighLocal file paths are automatically uploaded to remote inference.sh apps.Require explicit user approval before every local file upload and warn when paths leave the current project directory.
- FIX-004HighTwitter/X automation commands can create public or account-affecting actions.Require explicit confirmation for posts, DMs, follows, likes, retweets, and any use of authenticated social media accounts.
- FIX-005MediumThe skill recommends installing related skills through npx commands.Present related skills as documentation links and require user confirmation before installing any additional skill or package.
- FIX-006MediumAPI key setup is documented without detailed handling safeguards.Add guidance to keep API keys out of prompts, logs, shell history, and shared files, and prefer secret management where available.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable