Versioned security assessment

Report ID: SA-4121DE96

8/6/2026, 10:31:07 AM

infsh-cli security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
infsh-cli
Version
v5
Maintainer
inferen-sh
Source
github.com/inferen-sh/skills/tree/main/tools/infsh-cli/
Coverage
5 Files scanned · 608 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The documentation contains repeated remote installer commands that pipe live content to a shell, plus an unsafe manifest-driven download command. It also enables local file uploads and public social media actions without explicit consent controls; most other alerts are Markdown or documentation false positives.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 608 Lines analyzed

14 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 21 evidence locations

Capability review items (8)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Although the backticks are Markdown, the documented npx command installs a separate unpinned community skill. Executing it expands the trust boundary beyond the reviewed files.
Medium
SKILL.md:28
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The unquoted substitution derives curl arguments from a remote manifest through fragile text parsing. A changed or compromised manifest can redirect the binary download or inject curl options through word splitting.
Low
references/authentication.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL supplies a remote installer whose response is executed immediately. HTTPS does not protect against a compromised origin or unsafe installer update.
Low
references/authentication.md:44
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The reinstall command retrieves executable shell content from the fixed remote endpoint. This creates a genuine network supply-chain dependency.
Low
references/cli-reference.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The hardcoded endpoint is used to fetch an installer that is executed immediately. The network dependency is security relevant even though it is the documented vendor domain.
Low
SKILL.md:18
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is an active installer endpoint whose response is piped to a shell. Trust in this endpoint directly controls local code execution.
Low
SKILL.md:27
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums used to trust an executable from the same vendor origin. Origin compromise can therefore replace both the binary and its checksum.
Low
SKILL.md:28
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The remote manifest determines which executable archive curl downloads. The URL is not pinned, and its output is consumed through unquoted command substitution.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
references/authentication.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes an uninspected network response directly into sh. A compromised server, DNS path, or changed installer can execute arbitrary commands.
RISK-002 Critical
references/authentication.md:44
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The update guidance again executes remote shell content without local inspection or pinning. This is a direct remote code execution supply-chain pattern.
RISK-003 Critical
references/cli-reference.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documented installation command executes a live remote response through sh. There is no opportunity to verify the retrieved script before execution.
RISK-004 Critical
SKILL.md:18
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary setup flow executes downloaded shell text without review, version pinning, or prior signature verification. This can yield arbitrary local code execution.
RISK-005 High
SKILL.md:58-74references/running-apps.md:21-42
Automatic Local File Upload Can Expose Sensitive Data
The CLI automatically uploads any supplied local path to the hosted service. The skill provides no path allowlist, sensitivity check, or explicit upload confirmation.
Both files explicitly state that local paths are uploaded and show absolute, relative, and home-directory inputs. The missing consent and scope controls are visible in the reviewed guidance.
RISK-006 High
SKILL.md:51-52SKILL.md:72-73
Public Social Media Actions Lack Confirmation Controls
The examples can publish posts and media to Twitter or X, but the skill does not require a preview or user confirmation before consequential account changes.
The cited commands explicitly post text and media to an external account. No confirmation requirement appears around either example.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer content is piped directly to sh.
    Replace every pipe-to-shell command with a version-pinned download, then verify a separately anchored checksum and Sigstore signature before execution.
  2. FIX-002
    High
    The manual download parses a remote manifest with grep and unquoted command substitution.
    Use a structured JSON parser, validate the selected HTTPS URL, quote every expansion, pin a release version, and verify before installation.
  3. FIX-003
    High
    Local paths are uploaded without an explicit consent or sensitivity step.
    Require confirmation before each upload, display the resolved path and destination, and restrict uploads to user-approved directories.
  4. FIX-004
    High
    Social media commands can publish content without a required confirmation.
    Generate a preview and require explicit user approval immediately before any post, direct message, follow, like, or repost action.
  5. FIX-005
    Medium
    The related belt CLI skill installation is unpinned.
    Make the dependency optional, pin it to an immutable audited revision, and explain that it expands the security review boundary.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
4121de961d1b6f2ffca856260e239505c302452c
Content hash
ff4055cc8c904f06098398690e3e356fda6cbe7d7ac97410c4afef0991cf1434
Tree hash
e3f0051c7782dc25693866f11341633162524ceeb361d5736c353ee26381e845
Skill path
skills/inferen-sh/infsh-cli
Audit payload hash
d159fbc5318f9934f5b43c924dbdb952

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active