📦
Audit History
agent-tools - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 4 Latest
Jul 5, 2026, 05:31 PM
The skill is transparent about using the inference.sh CLI, but several install instructions use curl-to-shell and remote binary installation patterns. Most API-key and documentation-link findings are false positives, while external CLI execution, hosted-app data transfer, and Twitter/X automation remain real risks.
5
Files scanned
554
Lines analyzed
32
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remotely downloaded installer directly into sh. This can execute changed or compromised remote content without local inspection.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall example repeats the curl-to-shell pattern. It allows remote script content to execute immediately on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation example pipes a remote script directly to sh. That is a recognized high-risk install pattern even when the domain is expected.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install instruction executes remote shell content with sh. This is a critical supply-chain risk if the endpoint or transport is compromised.
High
Public Social Media Automation Capability
The skill includes examples for x/post-tweet and lists Twitter/X actions such as posting, direct messages, follows, likes, and retweets. These actions can affect a public account when run with authenticated credentials.
The cited lines explicitly show x/post-tweet and Twitter/X automation commands. Misuse depends on credentials, but the business action is clear.
Medium
User Data Sent to Hosted Third-Party Apps
The skill routes prompts and input files to hosted apps such as image, video, LLM, search, and 3D services through infsh app run. This can expose user content to the selected app provider.
The examples show remote app execution with prompts, and the references state that outputs are returned through cloud URLs. The behavior is intended but privacy-relevant.
Capability review items (22)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command uses nested shell substitution with a remote manifest to build a download URL. A changed manifest can influence what binary is downloaded.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install command moves a downloaded executable into ~/.local/bin. That is a normal user install path, but it places remote code in PATH.
Medium
Ruby/shell backtick execution
> ```bash
The referenced manual install block contains shell commands that download, verify, extract, and install a remote binary. It is documented setup, but it still executes external commands on the user system.
Medium
Ruby/shell backtick execution · 2 occurrences
```bash
The quick examples contain infsh app run commands that send prompts to hosted AI apps. This is intended behavior, but it is real external command execution.
Medium
Ruby/shell backtick execution
| List all apps | `infsh app list` |
The command invokes infsh to list remote apps. It is expected read-only behavior, but it still runs an external CLI against a network service.
Medium
Ruby/shell backtick execution
| Search apps | `infsh app list --search "flux"` |
The command invokes infsh search against the hosted app catalog. It is a legitimate command, but it is external CLI activity.
Medium
Ruby/shell backtick execution
| Filter by category | `infsh app list --category image` |
The category filter runs infsh against the remote app catalog. This is intended but still an external command path.
Medium
Ruby/shell backtick execution
| Get app details | `infsh app get google/veo-3-1-fast` |
The command retrieves remote app details through infsh. It is normal discovery behavior, but it depends on external CLI execution.
Medium
Ruby/shell backtick execution
| Generate sample input | `infsh app sample google/veo-3-1-fast --save input.json` |
The command generates and saves a sample input file through infsh. It combines external CLI use with a local file write.
Medium
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a hosted AI app with local input. It can transmit user-provided data to a remote service.
Medium
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait run command submits remote work and returns before completion. It can transmit data and leave asynchronous jobs running.
Medium
Ruby/shell backtick execution
| Check task status | `infsh task get <task-id>` |
The task status command calls the remote inference.sh service. It is expected behavior, but it is still external command execution.
Medium
Template literal with command substitution
> ```bash
The manual install block includes shell substitution and several shell commands. It is legitimate installation guidance, but it raises command execution risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for local executables. This is expected installation behavior, but it changes user executable search paths.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The hardcoded URL is used in an installer command that retrieves remote shell content. The network endpoint is expected, but it is security-relevant because it controls the script source.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The Markdown image embeds a remote cloud.inference.sh asset. It is not code execution, but rendering the skill can trigger a third-party network request.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from a fixed remote endpoint. This is expected verification flow, but it is still a trusted network dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command downloads and parses a remote manifest to select a binary URL. This network-controlled input influences the installation artifact.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (4)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 5, 2026, 05:31 PM
The skill is transparent about using the inference.sh CLI, but several install instructions use curl-to-shell and remote binary installation patterns. Most API-key and documentation-link findings are false positives, while external CLI execution, hosted-app data transfer, and Twitter/X automation remain real risks.
5
Files scanned
554
Lines analyzed
32
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remotely downloaded installer directly into sh. This can execute changed or compromised remote content without local inspection.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall example repeats the curl-to-shell pattern. It allows remote script content to execute immediately on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation example pipes a remote script directly to sh. That is a recognized high-risk install pattern even when the domain is expected.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install instruction executes remote shell content with sh. This is a critical supply-chain risk if the endpoint or transport is compromised.
High
Public Social Media Automation Capability
The skill includes examples for x/post-tweet and lists Twitter/X actions such as posting, direct messages, follows, likes, and retweets. These actions can affect a public account when run with authenticated credentials.
The cited lines explicitly show x/post-tweet and Twitter/X automation commands. Misuse depends on credentials, but the business action is clear.
Medium
User Data Sent to Hosted Third-Party Apps
The skill routes prompts and input files to hosted apps such as image, video, LLM, search, and 3D services through infsh app run. This can expose user content to the selected app provider.
The examples show remote app execution with prompts, and the references state that outputs are returned through cloud URLs. The behavior is intended but privacy-relevant.
Capability review items (22)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command uses nested shell substitution with a remote manifest to build a download URL. A changed manifest can influence what binary is downloaded.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install command moves a downloaded executable into ~/.local/bin. That is a normal user install path, but it places remote code in PATH.
Medium
Ruby/shell backtick execution
> ```bash
The referenced manual install block contains shell commands that download, verify, extract, and install a remote binary. It is documented setup, but it still executes external commands on the user system.
Medium
Ruby/shell backtick execution · 2 occurrences
```bash
The quick examples contain infsh app run commands that send prompts to hosted AI apps. This is intended behavior, but it is real external command execution.
Medium
Ruby/shell backtick execution
| List all apps | `infsh app list` |
The command invokes infsh to list remote apps. It is expected read-only behavior, but it still runs an external CLI against a network service.
Medium
Ruby/shell backtick execution
| Search apps | `infsh app list --search "flux"` |
The command invokes infsh search against the hosted app catalog. It is a legitimate command, but it is external CLI activity.
Medium
Ruby/shell backtick execution
| Filter by category | `infsh app list --category image` |
The category filter runs infsh against the remote app catalog. This is intended but still an external command path.
Medium
Ruby/shell backtick execution
| Get app details | `infsh app get google/veo-3-1-fast` |
The command retrieves remote app details through infsh. It is normal discovery behavior, but it depends on external CLI execution.
Medium
Ruby/shell backtick execution
| Generate sample input | `infsh app sample google/veo-3-1-fast --save input.json` |
The command generates and saves a sample input file through infsh. It combines external CLI use with a local file write.
Medium
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a hosted AI app with local input. It can transmit user-provided data to a remote service.
Medium
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait run command submits remote work and returns before completion. It can transmit data and leave asynchronous jobs running.
Medium
Ruby/shell backtick execution
| Check task status | `infsh task get <task-id>` |
The task status command calls the remote inference.sh service. It is expected behavior, but it is still external command execution.
Medium
Template literal with command substitution
> ```bash
The manual install block includes shell substitution and several shell commands. It is legitimate installation guidance, but it raises command execution risk.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for local executables. This is expected installation behavior, but it changes user executable search paths.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The hardcoded URL is used in an installer command that retrieves remote shell content. The network endpoint is expected, but it is security-relevant because it controls the script source.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The Markdown image embeds a remote cloud.inference.sh asset. It is not code execution, but rendering the skill can trigger a third-party network request.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from a fixed remote endpoint. This is expected verification flow, but it is still a trusted network dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command downloads and parses a remote manifest to select a binary URL. This network-controlled input influences the installation artifact.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (4)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jun 30, 2026, 03:36 AM
Static analysis flagged many command and network patterns, but most are markdown examples for the documented infsh CLI rather than executable code. Confirmed concerns are the remote installer piped to sh, authenticated cloud execution, API key configuration, and minor filesystem writes for shell completion; no prompt injection or malicious exfiltration intent was found.
5
Files scanned
554
Lines analyzed
10
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Remote Installer Piped to Shell
The documentation instructs users to download an installer from a remote URL and pipe it directly to sh. This is a supply-chain risk because a changed endpoint, compromised transport path, or compromised host could execute arbitrary installer code before local review.
The pipe-to-shell pattern is directly present in installation examples. The surrounding documentation offers a manual install path and checksum discussion, so this is a real but not clearly malicious risk.
Medium
Authenticated Cloud App Execution
The skill is designed to run hosted inference.sh apps over the network using the local infsh CLI. This is expected behavior, but prompts, files, generated outputs, and Twitter/X actions may leave the local environment depending on the selected app.
The skill purpose and examples clearly involve network execution of remote apps. The behavior is legitimate for this skill, but users need to understand data disclosure and side-effect risks.
Medium
references/authentication.md:25-33references/authentication.md:49-53references/cli-reference.md:68-72
API Key Configuration Guidance
The documentation tells users to configure INFSH_API_KEY for CI/CD and notes that it overrides local config. This is normal authentication guidance, but exposed environment variables could allow unauthorized use of the account.
The files explicitly document an API key environment variable. There is no evidence the skill reads or exfiltrates the key itself, so the risk is credential handling rather than malicious behavior.
Low
Markdown Command Examples Trigger Static Detections
Most external command findings are CLI examples inside documentation. They are not executable skill code, and the declared tool permission is limited to Bash(infsh *), but the examples still guide users to run commands with cloud side effects.
The flagged lines are fenced markdown command examples and command tables. Context strongly supports false positives for direct code execution inside the skill.
Low
Checksum References Misclassified as Weak Cryptography
Static analysis flagged weak cryptography, but the reviewed content references SHA-256 checksum verification for downloaded binaries. This is a safety control, not a weak cryptographic algorithm use in skill code.
The clearest reviewed occurrence is SHA-256 checksum documentation. Some analyzer line mappings point at tables, so there is no evidence of implemented weak cryptography.
Low
Shell Completion File Writes
The CLI reference includes shell completion examples that write generated completion files under system or user shell configuration paths. This is common CLI setup behavior, but users should review paths before running commands.
The filesystem writes are visible in documentation examples and are limited to installation or shell completion paths. There is no evidence of hidden persistence or arbitrary file modification.
Risk Factors
⚙️ External commands (4)
🌐 Network access (4)
🔑 Env variables (3)
📁 Filesystem access (3)
Detected Patterns
Pipe Remote Script to ShellRemote Service Actions From CLI Examples
Audited by: codex
Feb 22, 2026, 08:40 AM
This is a documentation skill for the inference.sh CLI platform. All static findings are false positives - the skill contains only documentation with CLI examples. The allowed-tools restriction to Bash(infsh *) limits execution to the official inference.sh CLI only. Network access is to inference.sh API endpoints, and credential handling is through standard CLI authentication.
5
Files scanned
554
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (138)
references/app-discovery.md:5-7 references/app-discovery.md:7-11 references/app-discovery.md:11-13 references/app-discovery.md:13-17 references/app-discovery.md:17-23 references/app-discovery.md:23-27 references/app-discovery.md:27-32 references/app-discovery.md:32-36 references/app-discovery.md:36-40 references/app-discovery.md:40-44 references/app-discovery.md:44-46 references/app-discovery.md:46-50 references/app-discovery.md:50-52 references/app-discovery.md:52-56 references/app-discovery.md:56-58 references/app-discovery.md:58-64 references/app-discovery.md:64-66 references/app-discovery.md:66-72 references/app-discovery.md:72-75 references/app-discovery.md:75-79 references/app-discovery.md:79-82 references/app-discovery.md:82-89 references/app-discovery.md:89-90 references/app-discovery.md:90-91 references/app-discovery.md:91-92 references/app-discovery.md:92-93 references/app-discovery.md:93-96 references/app-discovery.md:96-97 references/app-discovery.md:97-98 references/app-discovery.md:98-99 references/app-discovery.md:99-100 references/app-discovery.md:100-103 references/app-discovery.md:103-104 references/app-discovery.md:104-105 references/app-discovery.md:105-106 references/authentication.md:5-7 references/authentication.md:7-11 references/authentication.md:11-13 references/authentication.md:13-19 references/authentication.md:19-21 references/authentication.md:21-29 references/authentication.md:29-31 references/authentication.md:31-37 references/authentication.md:37-39 references/authentication.md:39-43 references/authentication.md:43-45 references/authentication.md:45-51 references/authentication.md:51-53 references/cli-reference.md:5-7 references/cli-reference.md:7-13 references/cli-reference.md:13-14 references/cli-reference.md:14-15 references/cli-reference.md:15-16 references/cli-reference.md:16-17 references/cli-reference.md:17-25 references/cli-reference.md:25-26 references/cli-reference.md:26-27 references/cli-reference.md:27-28 references/cli-reference.md:28-29 references/cli-reference.md:29-30 references/cli-reference.md:30-31 references/cli-reference.md:31-32 references/cli-reference.md:32-33 references/cli-reference.md:33-34 references/cli-reference.md:34-35 references/cli-reference.md:35-36 references/cli-reference.md:36-42 references/cli-reference.md:42-43 references/cli-reference.md:43-44 references/cli-reference.md:44-45 references/cli-reference.md:45-46 references/cli-reference.md:46-52 references/cli-reference.md:52-53 references/cli-reference.md:53-54 references/cli-reference.md:54-60 references/cli-reference.md:60-61 references/cli-reference.md:61-62 references/cli-reference.md:62-63 references/cli-reference.md:63-64 references/cli-reference.md:64-65 references/cli-reference.md:65-66 references/cli-reference.md:66-72 references/cli-reference.md:72-76 references/cli-reference.md:76-85 references/cli-reference.md:85-89 references/cli-reference.md:89-91 references/cli-reference.md:91-92 references/cli-reference.md:92-93 references/cli-reference.md:93-94 references/cli-reference.md:94-95 references/cli-reference.md:95-97 references/running-apps.md:5-7 references/running-apps.md:7-11 references/running-apps.md:11-13 references/running-apps.md:13-17 references/running-apps.md:17-19 references/running-apps.md:19-25 references/running-apps.md:25-27 references/running-apps.md:27-31 references/running-apps.md:31-33 references/running-apps.md:33-35 references/running-apps.md:35-37 references/running-apps.md:37-39 references/running-apps.md:39-45 references/running-apps.md:45-61 references/running-apps.md:61-65 references/running-apps.md:65-76 references/running-apps.md:76-80 references/running-apps.md:80-83 references/running-apps.md:83-89 references/running-apps.md:89-92 references/running-apps.md:92-96 references/running-apps.md:96-105 references/running-apps.md:105-111 references/running-apps.md:111-117 references/running-apps.md:117-125 references/running-apps.md:125-134 references/running-apps.md:134-140 references/running-apps.md:140-141 SKILL.md:15-18 SKILL.md:18-20 SKILL.md:20-23 SKILL.md:23-32 SKILL.md:32-36 SKILL.md:36-54 SKILL.md:54-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-83 SKILL.md:83-109 SKILL.md:26 SKILL.md:26 SKILL.md:23-32
🌐 Network access (32)
references/app-discovery.md:110 references/app-discovery.md:111 references/app-discovery.md:112 references/authentication.md:6 references/authentication.md:44 references/authentication.md:57 references/authentication.md:58 references/authentication.md:59 references/cli-reference.md:6 references/cli-reference.md:101 references/cli-reference.md:102 references/cli-reference.md:103 references/cli-reference.md:104 references/running-apps.md:129 references/running-apps.md:146 references/running-apps.md:147 references/running-apps.md:148 SKILL.md:7 SKILL.md:11 SKILL.md:11 SKILL.md:16 SKILL.md:20 SKILL.md:20 SKILL.md:25 SKILL.md:26 SKILL.md:120 SKILL.md:121 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:125 SKILL.md:126
🔑 Env variables (3)
📁 Filesystem access (4)
Audited by: claude