Most external-command findings are Markdown backtick false positives or documented infsh examples. The quick start contains a real curl-to-sh installer pattern and hardcoded installer URL, which are unsafe for automatic trust. No prompt-injection text or additional semantic malware intent was found.
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 17 instructs users or agents to execute network-delivered shell code with curl piped into sh. This pattern can run arbitrary installer code without local review.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The quick start range contains a curl command piped directly to sh before login. A community skill recommending remote installer execution creates a supply-chain risk.
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL is used as the source for a remote installer that is piped into sh. This is a real network trust risk, not a passive documentation link.
Most external-command findings are Markdown backtick false positives or documented infsh examples. The quick start contains a real curl-to-sh installer pattern and hardcoded installer URL, which are unsafe for automatic trust. No prompt-injection text or additional semantic malware intent was found.
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 17 instructs users or agents to execute network-delivered shell code with curl piped into sh. This pattern can run arbitrary installer code without local review.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The quick start range contains a curl command piped directly to sh before login. A community skill recommending remote installer execution creates a supply-chain risk.
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL is used as the source for a remote installer that is piped into sh. This is a real network trust risk, not a passive documentation link.
The audit confirms a high-risk remote installer pattern: the Quick Start pipes a downloaded script into a shell. Most Ruby backtick and weak-crypto static findings are false positives caused by Markdown code spans, model identifiers, and documentation text. The skill also intentionally runs an external CLI and sends prompts, image URLs, audio URLs, and video URLs to inference.sh services.
The Quick Start instructs users to download an installer from https://cli.inference.sh and pipe it directly to sh. This is dangerous because any compromise of the endpoint, transport path, or install script can execute arbitrary code before user review.
The exact pipe-to-shell command is present in the Quick Start. The surrounding install note mentions checksums, but the one-line installer still executes remote code directly.
The skill is built around infsh app run commands that send prompts and media references to inference.sh applications. This is expected behavior, but it exposes user prompts and media URLs to a third-party service.
Multiple examples invoke the external infsh CLI with prompts, image URLs, audio URLs, and video URLs. This is core functionality, not hidden behavior, but it is still a privacy and network risk.
The related-skills section recommends npx skills add commands for several other skills. Installing additional community skills expands the trusted code and instruction surface beyond this package.
The commands are documented recommendations and not automatically executed. The risk depends on user action and the security posture of the referenced skills.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Backtick Execution Findings Are False Positives
The static Ruby backtick detections correspond to Markdown fenced examples and inline code spans, not Ruby source execution. No evidence found that the skill itself invokes Ruby backticks.
The reviewed file is Markdown and the matched backticks delimit examples or inline identifiers. There is no Ruby file or runtime context in the analyzed evidence.
The weak cryptography alerts point to descriptive Markdown text, including the term SHA-256 in an install note and table content. No evidence found of cryptographic implementation or weak algorithm use.
The cited lines are front matter description and a Markdown table header area. They do not implement hashing, encryption, or verification logic.
The hardcoded URLs are links to the inference.sh site, hosted images, documentation, and placeholder media inputs. These are expected for a skill that documents a hosted video generation service.
The URLs are visible documentation links or placeholder input examples. No hidden exfiltration endpoint or obfuscated network target was found in SKILL.md.
Static analysis flagged 65 patterns, but all are false positives from documentation content. The external_commands detections (43 locations) are CLI usage examples in markdown, not executable code. Network detections (19 URLs) are documentation links. The skill restricts bash access to infsh commands only via allowed-tools directive. One low-severity finding for curl-to-shell installation pattern in documentation, which is standard practice with checksum verification.
1
Files scanned
178
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Documentation includes curl piped to sh for CLI installation. While this is standard practice for CLI tools and the script verifies checksums, users should be aware this pattern downloads and executes remote code.