Versioned security assessment

Report ID: SA-F5FFA730

6/30/2026, 3:54:09 AM

agent-tools security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: agent-tools
Version: v2
Maintainer: inference-sh-8
Source: github.com/inference-sh-8/skills/tree/main/skills/agent-tools/
Coverage: 5 Files scanned · 554 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

AI review confirms that most static command findings are documentation examples for the intended inference.sh CLI workflow, not hidden executable code. However, the skill repeatedly instructs users to install software with curl piped to sh, run cloud-hosted AI apps, use an API key, and write local shell files, so publication should require manual trust review. No prompt injection attempt or confirmed malicious data exfiltration text was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 554 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 30 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 136 evidence locations

Capability review items (6)

High

SKILL.md:15-20 references/authentication.md:5-7 references/authentication.md:41-45 references/cli-reference.md:5-7

Pipe-to-Shell Installer Instructions

The skill instructs users to run curl piped directly to sh for installing the inference.sh CLI. This executes remote code from a network endpoint and is dangerous if the endpoint, transport, or installer is compromised, even though the file also documents a manual install path.

The exact pipe-to-shell command appears in multiple installation sections. The surrounding context is legitimate CLI setup, but remote shell execution remains a real high-risk pattern.

High

SKILL.md:36-54 SKILL.md:69-79 references/running-apps.md:5-13 references/running-apps.md:119-133

Broad Cloud Execution Through External CLI

The skill is designed to run many remote AI applications through infsh, including LLMs, media generation, search, and Twitter/X automation. User inputs and task results can leave the local environment for cloud processing, and some app categories can perform account actions.

The listed commands and capability tables clearly show intended network execution. This is not necessarily malicious, but it creates material data exposure and account-action risk.

Medium

references/authentication.md:15 references/authentication.md:25-33 references/authentication.md:47-53 references/cli-reference.md:68-72

API Key and Local Credential Handling

The authentication guide tells users to store credentials locally and use INFSH_API_KEY for scripts or CI/CD. This is expected for a CLI, but users need to understand that secrets may be present in local configuration or environment variables.

The secret-related text is explicit and tied to normal authentication. I found no evidence that the skill asks to read or exfiltrate existing unrelated secrets.

Medium

SKILL.md:23-32 references/cli-reference.md:76-85 references/running-apps.md:21-39 references/running-apps.md:94-105

Filesystem Writes for Installation and CLI Output

The documentation includes commands that write binaries, shell completions, sample input files, app lists, and task results. These are legitimate CLI operations, but they can modify the local environment and create files containing user prompts or generated outputs.

The write locations and save flags are documented directly. The risk is moderate because the operations are transparent and user-directed.

Low

SKILL.md:118-126 references/app-discovery.md:108-112 references/authentication.md:55-59 references/cli-reference.md:99-104

Hardcoded Documentation URLs

The static network findings mostly identify inference.sh documentation links, image links, and API reference URLs. These links support the skill documentation and do not by themselves indicate covert network behavior.

The URLs are visible documentation references. I did not find evidence that they are used for hidden tracking or exfiltration.

Low

references/app-discovery.md:3-84 references/cli-reference.md:19-67 references/running-apps.md:41-117 SKILL.md:56-67

Static Command Detections Are Mostly Markdown Examples

Many external command detections are command examples in markdown tables or fenced bash blocks. They are relevant to the skill purpose and are not automatically executed by the skill content itself.

The context shows markdown documentation, not hidden script execution. The commands still matter because agents or users may follow them.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable