Versioned security assessment

Report ID: SA-795D42EC

7/5/2026, 5:42:39 PM

agent-tools security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-tools
Version
v3
Maintainer
inference-sh-7
Source
github.com/inference-sh-7/skills/tree/main/skills/agent-tools/
Coverage
5 Files scanned · 554 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The audit confirms critical curl pipe-to-shell installer risks. It also confirms high-risk manual installation from a remote manifest. Many API key and documentation-link findings are false positives, but broad infsh permissions and social media actions remain risky.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 554 Lines analyzed

23 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 17 evidence locations

Capability review items (17)
Critical
SKILL.md:15-18
Ruby/shell backtick execution
```bash
The referenced shell block contains the remote installer and login command. The pipe-to-shell installer creates real command execution risk.
High
SKILL.md:23-32
Ruby/shell backtick execution
> ```bash
The manual install block downloads release artifacts, derives a binary URL from a remote manifest, and installs the result into PATH. That is legitimate setup, but it has supply-chain and local execution impact.
High
SKILL.md:26
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command substitution fetches a remote manifest and extracts a download URL before running curl. This hides the exact binary URL from the static command and increases supply-chain risk.
High
SKILL.md:23-32
Template literal with command substitution
> ```bash
The manual install block includes command substitution from a remote manifest and then installs the downloaded binary. The label is imprecise, but the command-substitution risk is real.
High
SKILL.md:31
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command moves a downloaded binary into ~/.local/bin, a PATH location under the user home directory. If the binary is compromised, future shell sessions may execute it.
High
SKILL.md:31
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The same install step writes into a hidden home-directory path used for local executables. This is expected setup, but it creates persistent local execution impact.
Medium
SKILL.md:36-54
Ruby/shell backtick execution
```bash
The quick examples run infsh app commands that submit prompts to external cloud services, including search and social posting examples. This is intended functionality, but the external command side effects are real.
Medium
SKILL.md:65-66
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with an input file, which may transmit local prompt data to an external service. The risk is inherent to the documented workflow.
Medium
SKILL.md:66-67
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait command submits a cloud job asynchronously and can consume credits or process data without immediate review. It is intended behavior but security relevant.
Medium
SKILL.md:83-109
Ruby/shell backtick execution
```bash
The related-skills block uses npx skills add commands to install additional remote skills. That can expand the trusted code and instruction surface beyond this package.
Low
references/authentication.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This URL is used in a curl installer command, so it can fetch remote code during setup. The network dependency is expected but security relevant.
Low
references/authentication.md:44
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This reinstall instruction fetches the same remote installer URL. It is expected setup behavior, but the external download path is a real risk.
Low
references/cli-reference.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is part of an installer command that downloads remote content. This is normal for CLI setup, but it is still a real external network dependency.
Low
SKILL.md:16
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL appears in a curl installer command. It is an expected setup dependency, but it downloads remote content during installation.
Low
SKILL.md:20
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The link points to the installer in the installation explanation. It reinforces reliance on a mutable remote script, though it is weaker evidence than the executable command line.
Low
SKILL.md:25
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksum metadata from a remote host. This is part of legitimate verification, but it is still an external network dependency in the install path.
Low
SKILL.md:26
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command downloads a remote manifest and binary URL during manual installation. This creates a real external network dependency for executable setup.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
references/authentication.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote HTTPS response directly into sh. If the endpoint or transport is compromised, arbitrary shell code could run during installation.
RISK-002 Critical
references/authentication.md:44
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall path repeats the pipe-to-shell installer pattern. This remains a critical supply-chain risk even when used for a legitimate CLI.
RISK-003 Critical
references/cli-reference.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The CLI reference recommends curl piped directly to sh. This can execute unreviewed remote script content on the user machine.
RISK-004 Critical
SKILL.md:16
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install command pipes a remote script directly into sh. This is a critical pattern because remote content executes before the user can inspect it.
RISK-005 High
SKILL.md:4references/cli-reference.md:60-66
Broad infsh Command Permission
The skill allows Bash(infsh *) and the CLI reference includes deploy and pull commands. This grants a large cloud command surface beyond narrow app execution.
The allowed-tools line explicitly permits all infsh subcommands, and the reference documents deploy and pull operations. This is not prompt injection, but it broadens account-impacting actions.
RISK-006 High
SKILL.md:49-50SKILL.md:78
Social Media Account Actions
The examples include posting to Twitter/X, and the capability table lists direct messages, follows, likes, and retweets. These actions can publish or modify account state if run without user confirmation.
The cited lines explicitly describe X/Twitter write actions. Static command detection does not capture the business risk of public posting and account interaction.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer commands pipe downloaded content into sh.
    Remove curl pipe-to-shell examples or replace them with pinned release downloads, checksum verification, signature verification, and explicit user confirmation.
  2. FIX-002
    High
    Manual install derives the binary URL through shell command substitution against a remote manifest.
    Publish fixed versioned download URLs and checksums, and avoid parsing remote manifests inside shell commands.
  3. FIX-003
    High
    The allowed Bash pattern permits all infsh subcommands.
    Narrow allowed commands where possible and require confirmation before deploy, pull, account, billing, or social media operations.
  4. FIX-004
    Medium
    The skill documents API key use through INFSH_API_KEY.
    Keep examples as placeholders and instruct users not to paste real API keys into prompts, logs, or shared files.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable