Versioned security assessment

Report ID: SA-40D5E768

6/30/2026, 3:36:31 AM

agent-tools security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: agent-tools
Version: v2
Maintainer: inference-sh-6
Source: github.com/inference-sh-6/skills/tree/main/skills/agent-tools/
Coverage: 5 Files scanned · 554 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged many command and network patterns, but most are markdown examples for the documented infsh CLI rather than executable code. Confirmed concerns are the remote installer piped to sh, authenticated cloud execution, API key configuration, and minor filesystem writes for shell completion; no prompt injection or malicious exfiltration intent was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 554 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Capability review items (6)

Medium

SKILL.md:15-17 references/authentication.md:5-7 references/cli-reference.md:5-7

Remote Installer Piped to Shell

The documentation instructs users to download an installer from a remote URL and pipe it directly to sh. This is a supply-chain risk because a changed endpoint, compromised transport path, or compromised host could execute arbitrary installer code before local review.

The pipe-to-shell pattern is directly present in installation examples. The surrounding documentation offers a manual install path and checksum discussion, so this is a real but not clearly malicious risk.

Medium

SKILL.md:36-53 references/running-apps.md:45-60 references/running-apps.md:119-129

Authenticated Cloud App Execution

The skill is designed to run hosted inference.sh apps over the network using the local infsh CLI. This is expected behavior, but prompts, files, generated outputs, and Twitter/X actions may leave the local environment depending on the selected app.

The skill purpose and examples clearly involve network execution of remote apps. The behavior is legitimate for this skill, but users need to understand data disclosure and side-effect risks.

Medium

references/authentication.md:25-33 references/authentication.md:49-53 references/cli-reference.md:68-72

API Key Configuration Guidance

The documentation tells users to configure INFSH_API_KEY for CI/CD and notes that it overrides local config. This is normal authentication guidance, but exposed environment variables could allow unauthorized use of the account.

The files explicitly document an API key environment variable. There is no evidence the skill reads or exfiltrates the key itself, so the risk is credential handling rather than malicious behavior.

Low

references/app-discovery.md:5-82 references/running-apps.md:5-117 SKILL.md:58-67

Markdown Command Examples Trigger Static Detections

Most external command findings are CLI examples inside documentation. They are not executable skill code, and the declared tool permission is limited to Bash(infsh *), but the examples still guide users to run commands with cloud side effects.

The flagged lines are fenced markdown command examples and command tables. Context strongly supports false positives for direct code execution inside the skill.

Low

SKILL.md:20-28 references/authentication.md:33 references/cli-reference.md:11-23

Checksum References Misclassified as Weak Cryptography

Static analysis flagged weak cryptography, but the reviewed content references SHA-256 checksum verification for downloaded binaries. This is a safety control, not a weak cryptographic algorithm use in skill code.

The clearest reviewed occurrence is SHA-256 checksum documentation. Some analyzer line mappings point at tables, so there is no evidence of implemented weak cryptography.

Low

references/cli-reference.md:74-84 SKILL.md:24-31

Shell Completion File Writes

The CLI reference includes shell completion examples that write generated completion files under system or user shell configuration paths. This is common CLI setup behavior, but users should review paths before running commands.

The filesystem writes are visible in documentation examples and are limited to installation or shell completion paths. There is no evidence of hidden persistence or arbitrary file modification.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable