📦
Audit History
infsh-cli - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Aug 6, 2026, 10:31 AM | 6 confirmed | 8 | No capability change |
| v4 | Jul 5, 2026, 03:47 PM | 6 confirmed | 11 | No capability change |
| v3 | Jul 5, 2026, 03:47 PM | 6 confirmed | 11 | No capability change |
| v2 | Jun 30, 2026, 03:53 AM | No confirmed findings | 5 | No capability change |
| v1 | Mar 15, 2026, 08:17 AM | 2 confirmed | 2 | Baseline |
Audit version 5 Latest
Aug 6, 2026, 10:31 AM
The documentation contains repeated remote installer commands that pipe live content to a shell, plus an unsafe manifest-driven download command. It also enables local file uploads and public social media actions without explicit consent controls; most other alerts are Markdown or documentation false positives.
5
Files scanned
608
Lines analyzed
18
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes an uninspected network response directly into sh. A compromised server, DNS path, or changed installer can execute arbitrary commands.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The update guidance again executes remote shell content without local inspection or pinning. This is a direct remote code execution supply-chain pattern.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documented installation command executes a live remote response through sh. There is no opportunity to verify the retrieved script before execution.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary setup flow executes downloaded shell text without review, version pinning, or prior signature verification. This can yield arbitrary local code execution.
High
Automatic Local File Upload Can Expose Sensitive Data
The CLI automatically uploads any supplied local path to the hosted service. The skill provides no path allowlist, sensitivity check, or explicit upload confirmation.
Both files explicitly state that local paths are uploaded and show absolute, relative, and home-directory inputs. The missing consent and scope controls are visible in the reviewed guidance.
High
Public Social Media Actions Lack Confirmation Controls
The examples can publish posts and media to Twitter or X, but the skill does not require a preview or user confirmation before consequential account changes.
The cited commands explicitly post text and media to an external account. No confirmation requirement appears around either example.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Although the backticks are Markdown, the documented npx command installs a separate unpinned community skill. Executing it expands the trust boundary beyond the reviewed files.
Medium
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The unquoted substitution derives curl arguments from a remote manifest through fragile text parsing. A changed or compromised manifest can redirect the binary download or inject curl options through word splitting.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:18
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The URL supplies a remote installer whose response is executed immediately. HTTPS does not protect against a compromised origin or unsafe installer update.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums used to trust an executable from the same vendor origin. Origin compromise can therefore replace both the binary and its checksum.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The remote manifest determines which executable archive curl downloads. The URL is not pinned, and its output is consumed through unquoted command substitution.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (22)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-104 SKILL.md:104-130 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 5, 2026, 03:47 PM
The skill appears to be legitimate documentation for the inference.sh CLI, with no prompt injection or malicious override language found. Confirmed risks include remote pipe-to-shell installation, downloading binaries into the user PATH, automatic local file uploads to cloud services, and social media actions with external side effects.
5
Files scanned
596
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remotely downloaded installer directly into sh. That executes unaudited network content with the user account privileges.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command repeats the same remote pipe-to-shell pattern. This remains a critical supply-chain execution risk.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The CLI reference recommends executing a remote installer through sh. This is a known high-risk installation pattern.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary installation path pipes a remote script directly into sh. This can execute compromised or unexpected installer content.
High
Local File Upload to Cloud Services
The skill explains that local paths are automatically uploaded when used as inputs. This can expose sensitive media or documents if users pass unintended paths.
Both files explicitly state automatic uploads and show local image, audio, and media paths. This is an intentional data-transfer behavior, not only path syntax.
Medium
Social Media Automation Can Publish Externally
The skill includes Twitter/X actions for posts, direct messages, follows, likes, and retweets. These commands can create public or account-affecting side effects.
The file names concrete Twitter/X write actions, including posting and direct messages. This is clear external side-effect behavior even when user-authorized.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install moves a downloaded executable into ~/.local/bin, which commonly affects the user PATH. That is an expected install step but security sensitive.
Medium
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install pipeline uses shell command substitution to choose a binary URL from a remote manifest. It is an intentional shell pattern with supply-chain risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for local executables. It is legitimate installation behavior but can persist a downloaded binary.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
This line fetches an external installer from cli.inference.sh. It is paired with shell execution, so the network dependency is security relevant.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
This Markdown image points to a remote cloud URL that may be fetched by renderers. No malicious intent is evident, but it is still external content.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose links directly to the remote installer and describes binary download behavior. This is a low-severity external dependency, not a standalone exploit.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install instructions fetch checksums from dist.inference.sh. It is expected installer traffic, but still security relevant for binary trust.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a manifest from dist.inference.sh to choose a binary URL. A compromised manifest or host could affect the downloaded binary.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (20)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 5, 2026, 03:47 PM
The skill appears to be legitimate documentation for the inference.sh CLI, with no prompt injection or malicious override language found. Confirmed risks include remote pipe-to-shell installation, downloading binaries into the user PATH, automatic local file uploads to cloud services, and social media actions with external side effects.
5
Files scanned
596
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remotely downloaded installer directly into sh. That executes unaudited network content with the user account privileges.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command repeats the same remote pipe-to-shell pattern. This remains a critical supply-chain execution risk.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The CLI reference recommends executing a remote installer through sh. This is a known high-risk installation pattern.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary installation path pipes a remote script directly into sh. This can execute compromised or unexpected installer content.
High
Local File Upload to Cloud Services
The skill explains that local paths are automatically uploaded when used as inputs. This can expose sensitive media or documents if users pass unintended paths.
Both files explicitly state automatic uploads and show local image, audio, and media paths. This is an intentional data-transfer behavior, not only path syntax.
Medium
Social Media Automation Can Publish Externally
The skill includes Twitter/X actions for posts, direct messages, follows, likes, and retweets. These commands can create public or account-affecting side effects.
The file names concrete Twitter/X write actions, including posting and direct messages. This is clear external side-effect behavior even when user-authorized.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install moves a downloaded executable into ~/.local/bin, which commonly affects the user PATH. That is an expected install step but security sensitive.
Medium
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install pipeline uses shell command substitution to choose a binary URL from a remote manifest. It is an intentional shell pattern with supply-chain risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for local executables. It is legitimate installation behavior but can persist a downloaded binary.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
This line fetches an external installer from cli.inference.sh. It is paired with shell execution, so the network dependency is security relevant.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
This Markdown image points to a remote cloud URL that may be fetched by renderers. No malicious intent is evident, but it is still external content.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose links directly to the remote installer and describes binary download behavior. This is a low-severity external dependency, not a standalone exploit.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install instructions fetch checksums from dist.inference.sh. It is expected installer traffic, but still security relevant for binary trust.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a manifest from dist.inference.sh to choose a binary URL. A compromised manifest or host could affect the downloaded binary.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (20)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jun 30, 2026, 03:53 AM
Static analysis flagged many shell, network, credential, and filesystem patterns. Review found these are mostly documentation examples for the infsh CLI, but the skill still carries medium risk because it encourages pipe-to-shell installation, cloud execution, local file uploads, and API-key based authentication. No prompt injection attempt or confirmed malicious intent was found.
5
Files scanned
596
Lines analyzed
9
Review items
2
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
SKILL.md:16references/authentication.md:6references/authentication.md:44references/cli-reference.md:6
Pipe-to-Shell Installer Guidance
The skill recommends installing and reinstalling the CLI with curl piped directly to sh. This is a real supply chain risk because a remote script is executed immediately, even though the documentation also provides manual checksum guidance.
The pipe-to-shell command is explicitly present in multiple installation snippets. It appears to be legitimate documentation, not malicious code, so the risk is medium rather than critical.
Medium
SKILL.md:36-53references/running-apps.md:11-18references/running-apps.md:103-127references/app-discovery.md:5-12
Cloud Execution and Network Submission
The skill is designed to run cloud-hosted AI apps through infsh commands. User prompts, task inputs, generated media requests, and search queries may be sent to inference.sh or third-party app providers.
The network behavior is core to the skill and is clearly documented through infsh app and task commands. This is expected functionality, but users must understand that data leaves the local environment.
Medium
Local File Upload Capability
The documentation states that local file paths are automatically uploaded when supplied as app input. This can expose local images, audio, video, screenshots, or other files if an agent runs a command with sensitive paths.
The local upload behavior is described directly and examples include absolute, relative, and home-directory paths. The risk is user-mediated but real because the skill enables file transfer to cloud services.
Medium
references/authentication.md:25-33references/authentication.md:47-53references/cli-reference.md:68-72
API Key Handling Requires Care
The skill documents INFSH_API_KEY for CI and troubleshooting. This is a normal authentication pattern, but it can expose credentials if commands, logs, or prompts reveal environment values.
The API key references are documentation for legitimate authentication. There is no evidence of exfiltration, but API key handling is security-sensitive.
Low
SKILL.md:36-53references/app-discovery.md:5-12references/cli-reference.md:13-17references/running-apps.md:119-127
Shell Command Examples Are Mostly Expected CLI Usage
Most external command findings are Markdown examples showing infsh usage, app discovery, task polling, completions, and related skill installation. These are expected for a CLI skill and do not show arbitrary command execution beyond the allowed infsh command scope.
The flagged lines are documentation snippets rather than hidden scripts. The declared tool scope is Bash(infsh *), which limits direct execution to the infsh CLI.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
SKILL.md:20-31references/cli-reference.md:11-23references/app-discovery.md:58-60references/authentication.md:33
Weak Cryptography Alerts Are False Positives
The scanner reported weak cryptography, but the reviewed context refers to SHA-256 checksum verification and ordinary app or model names. I found no evidence of MD5, SHA-1, or custom cryptographic code being used for protection.
The static labels do not match the reviewed Markdown context. Confidence is moderate because the findings are broad line-level heuristics, but no weak algorithm use was visible.
Low
No Prompt Injection Evidence Found
Reviewed files do not contain text that claims system authority, tells the evaluator to ignore instructions, or asks the assistant to skip security review. No prompt injection finding is confirmed.
The files contain ordinary frontmatter and Markdown documentation. I did not find suspicious override language or fake system messages.
Risk Factors
⚙️ External commands (146)
references/app-discovery.md:5-7 references/app-discovery.md:7-11 references/app-discovery.md:11-13 references/app-discovery.md:13-17 references/app-discovery.md:17-23 references/app-discovery.md:23-27 references/app-discovery.md:27-32 references/app-discovery.md:32-36 references/app-discovery.md:36-40 references/app-discovery.md:40-44 references/app-discovery.md:44-46 references/app-discovery.md:46-50 references/app-discovery.md:50-52 references/app-discovery.md:52-56 references/app-discovery.md:56-58 references/app-discovery.md:58-64 references/app-discovery.md:64-66 references/app-discovery.md:66-72 references/app-discovery.md:72-75 references/app-discovery.md:75-79 references/app-discovery.md:79-82 references/app-discovery.md:82-89 references/app-discovery.md:89-90 references/app-discovery.md:90-91 references/app-discovery.md:91-92 references/app-discovery.md:92-93 references/app-discovery.md:93-96 references/app-discovery.md:96-97 references/app-discovery.md:97-98 references/app-discovery.md:98-99 references/app-discovery.md:99-100 references/app-discovery.md:100-103 references/app-discovery.md:103-104 references/app-discovery.md:104-105 references/app-discovery.md:105-106 references/authentication.md:5-7 references/authentication.md:7-11 references/authentication.md:11-13 references/authentication.md:13-19 references/authentication.md:19-21 references/authentication.md:21-29 references/authentication.md:29-31 references/authentication.md:31-37 references/authentication.md:37-39 references/authentication.md:39-43 references/authentication.md:43-45 references/authentication.md:45-51 references/authentication.md:51-53 references/cli-reference.md:5-7 references/cli-reference.md:7-13 references/cli-reference.md:13-14 references/cli-reference.md:14-15 references/cli-reference.md:15-16 references/cli-reference.md:16-17 references/cli-reference.md:17-25 references/cli-reference.md:25-26 references/cli-reference.md:26-27 references/cli-reference.md:27-28 references/cli-reference.md:28-29 references/cli-reference.md:29-30 references/cli-reference.md:30-31 references/cli-reference.md:31-32 references/cli-reference.md:32-33 references/cli-reference.md:33-34 references/cli-reference.md:34-35 references/cli-reference.md:35-36 references/cli-reference.md:36-42 references/cli-reference.md:42-43 references/cli-reference.md:43-44 references/cli-reference.md:44-45 references/cli-reference.md:45-46 references/cli-reference.md:46-52 references/cli-reference.md:52-53 references/cli-reference.md:53-54 references/cli-reference.md:54-60 references/cli-reference.md:60-61 references/cli-reference.md:61-62 references/cli-reference.md:62-63 references/cli-reference.md:63-64 references/cli-reference.md:64-65 references/cli-reference.md:65-66 references/cli-reference.md:66-72 references/cli-reference.md:72-76 references/cli-reference.md:76-85 references/cli-reference.md:85-89 references/cli-reference.md:89-91 references/cli-reference.md:91-92 references/cli-reference.md:92-93 references/cli-reference.md:93-94 references/cli-reference.md:94-95 references/cli-reference.md:95-97 references/running-apps.md:5-7 references/running-apps.md:7-11 references/running-apps.md:11-13 references/running-apps.md:13-17 references/running-apps.md:17-19 references/running-apps.md:19-25 references/running-apps.md:25-37 references/running-apps.md:37-40 references/running-apps.md:40-41 references/running-apps.md:41 references/running-apps.md:41-42 references/running-apps.md:42-48 references/running-apps.md:48-50 references/running-apps.md:50-54 references/running-apps.md:54-56 references/running-apps.md:56-58 references/running-apps.md:58-60 references/running-apps.md:60-62 references/running-apps.md:62-68 references/running-apps.md:68-84 references/running-apps.md:84-88 references/running-apps.md:88-99 references/running-apps.md:99-103 references/running-apps.md:103-106 references/running-apps.md:106-112 references/running-apps.md:112-115 references/running-apps.md:115-119 references/running-apps.md:119-128 references/running-apps.md:128-134 references/running-apps.md:134-140 references/running-apps.md:140-148 references/running-apps.md:148-157 references/running-apps.md:157-163 references/running-apps.md:163-164 SKILL.md:15-18 SKILL.md:18-20 SKILL.md:20-23 SKILL.md:23-32 SKILL.md:32-36 SKILL.md:36-54 SKILL.md:54-60 SKILL.md:60-72 SKILL.md:72-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-101 SKILL.md:101-127 SKILL.md:26 SKILL.md:26 SKILL.md:23-32
🌐 Network access (32)
references/app-discovery.md:110 references/app-discovery.md:111 references/app-discovery.md:112 references/authentication.md:6 references/authentication.md:44 references/authentication.md:57 references/authentication.md:58 references/authentication.md:59 references/cli-reference.md:6 references/cli-reference.md:101 references/cli-reference.md:102 references/cli-reference.md:103 references/cli-reference.md:104 references/running-apps.md:152 references/running-apps.md:169 references/running-apps.md:170 references/running-apps.md:171 SKILL.md:7 SKILL.md:11 SKILL.md:11 SKILL.md:16 SKILL.md:20 SKILL.md:20 SKILL.md:25 SKILL.md:26 SKILL.md:138 SKILL.md:139 SKILL.md:140 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144
🔑 Env variables (3)
📁 Filesystem access (5)
Detected Patterns
curl Piped to shAutomatic Local File Uploads
Audited by: codex
Mar 15, 2026, 08:17 AM
Static analysis flagged 203 patterns across 5 files (596 lines), but all findings are false positives. The detected 'external_commands' are markdown documentation showing CLI usage examples, not actual code execution. URLs are legitimate service endpoints. The curl|sh installation pattern is standard for CLI tools. Network access to inference.sh APIs is the intended functionality. Environment variable usage for API keys follows security best practices.
5
Files scanned
596
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
External Command Execution via CLI
The skill uses the infsh CLI tool which executes shell commands. This is inherent to the skill's purpose of running AI inference via command line. Users should verify the CLI source and understand it will make network requests to inference.sh APIs.
Low
Local File Access
The CLI supports uploading local files by accepting file paths in input parameters. Users should only provide files they intend to upload to the inference service.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Network Requests to External APIs
The skill makes HTTP requests to inference.sh and related domains (cli.inference.sh, dist.inference.sh, cloud.inference.sh). This is expected behavior for a cloud AI inference client.
Low
API Key Storage
The skill stores authentication credentials locally after login and supports INFSH_API_KEY environment variable. This is standard practice for CLI authentication.
Risk Factors
⚙️ External commands (2)
🌐 Network access (2)
🔑 Env variables (1)
📁 Filesystem access (1)
Audited by: claude