Most static backtick findings are Markdown formatting or documentation examples, but the installer command at SKILL.md:17 is a confirmed critical pipe-to-shell risk. Several infsh and npx examples are real external command guidance, and the skill intentionally sends TSX code and props to inference.sh. No prompt injection attempt was found in the reviewed file.
curl -fsSL https://cli.inference.sh | sh && infsh login
The command curls a remote installer and pipes it directly to sh. This executes unaudited network content immediately and is a classic supply-chain risk.
The skill sends React/Remotion component code and optional props to the inference.sh rendering service. Users could expose private source, media URLs, or sensitive data if they include it in render inputs.
SKILL.md shows infsh and Python SDK examples submitting code and props to inference.sh. This is the core feature, so it is a privacy boundary rather than covert exfiltration.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This fenced bash block instructs users to run a curl-to-shell installer and then use the infsh CLI. The command guidance is real execution guidance, not only Markdown formatting.
This bash example invokes infsh app run and sends component code to inference.sh. It is intended behavior, but it is real external command execution with third-party transfer.
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is used to fetch an installer from cli.inference.sh in a shell command. It is not exfiltration by itself, but it introduces a real network trust dependency.
Most static backtick findings are Markdown formatting or documentation examples, but the installer command at SKILL.md:17 is a confirmed critical pipe-to-shell risk. Several infsh and npx examples are real external command guidance, and the skill intentionally sends TSX code and props to inference.sh. No prompt injection attempt was found in the reviewed file.
curl -fsSL https://cli.inference.sh | sh && infsh login
The command curls a remote installer and pipes it directly to sh. This executes unaudited network content immediately and is a classic supply-chain risk.
The skill sends React/Remotion component code and optional props to the inference.sh rendering service. Users could expose private source, media URLs, or sensitive data if they include it in render inputs.
SKILL.md shows infsh and Python SDK examples submitting code and props to inference.sh. This is the core feature, so it is a privacy boundary rather than covert exfiltration.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This fenced bash block instructs users to run a curl-to-shell installer and then use the infsh CLI. The command guidance is real execution guidance, not only Markdown formatting.
This bash example invokes infsh app run and sends component code to inference.sh. It is intended behavior, but it is real external command execution with third-party transfer.
curl -fsSL https://cli.inference.sh | sh && infsh login
The URL is used to fetch an installer from cli.inference.sh in a shell command. It is not exfiltration by itself, but it introduces a real network trust dependency.
Static analysis found many command and URL patterns in SKILL.md. Review confirmed most shell backtick and weak crypto hits are markdown or wording false positives, but the remote installer and infsh rendering workflow are real elevated-risk behaviors that require user warning. No evidence found of prompt injection, credential exfiltration, persistence, or confirmed malicious intent.
TRUE_POSITIVE: The quick start tells users to run a remote install script with curl piped directly to sh. This is dangerous because script contents can change after review and execute with the user's local privileges. The install note describes checksum verification, but the pipe-to-shell command still requires trust in the remote endpoint.
The exact pipe-to-shell pattern is present and semantically executes a remote installer. Confidence is high on the risk, although the surrounding text indicates legitimate installation intent rather than malware.
TRUE_POSITIVE: The skill allows Bash access for infsh commands and documents infsh app run calls that submit TSX component code and props to inference.sh. This is the intended function, but it can expose proprietary code, rendered assets, or prompt-provided data to a third-party service.
The allowed tool declaration and repeated remote run examples clearly show external command and network behavior. The risk is moderate because the behavior is disclosed and central to the skill's purpose.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Backtick Command Flags Are Documentation Examples
FALSE_POSITIVE: Most shell execution findings point to fenced bash, tsx, or python examples in documentation. These snippets demonstrate how to call the remote renderer and are not hidden Ruby backtick execution inside a runtime script.
The flagged locations are inside markdown code fences or inline code examples. They are visible documentation, not concealed executable skill code.
Weak Cryptography Alerts Are Text Matching False Positives
FALSE_POSITIVE: The weak cryptographic algorithm alerts do not identify use of MD5, SHA-1, DES, or another weak primitive. The relevant security text says SHA-256 checksum verification, and other hits appear to come from ordinary words such as description.
Line 29 references SHA-256, which is not a weak checksum for this purpose. The other cited lines do not contain cryptographic operations.
Hardcoded URLs Are Mostly Documentation and Asset Links
FALSE_POSITIVE: The non-installer URLs point to the inference.sh website, an image asset, Remotion documentation, and inference.sh documentation. No evidence found that these links exfiltrate secrets or contact unrelated infrastructure.
The URLs are visible documentation or asset references that match the skill's stated service. The installer URL is handled separately as a medium finding.
All 43 static findings are false positives. External commands (infsh app run) are hardcoded service invocations, not arbitrary execution. Network requests go to the legitimate inference.sh rendering service. No malicious patterns detected.