📦
Audit History
agent-tools - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 6, 2026, 03:40 PM | 6 confirmed | 23 | No capability change |
| v3 | Jul 6, 2026, 03:40 PM | 6 confirmed | 23 | Contains scripts |
| v2 | Jun 30, 2026, 04:11 AM | 4 confirmed | 1 | Contains scriptsExternal commandsNetwork accessEnv variablesFilesystem access |
| v1 | Feb 26, 2026, 08:57 AM | No confirmed findings | 0 | Baseline |
Audit version 4 Latest
Jul 6, 2026, 03:40 PM
The skill is legitimate documentation for the inference.sh CLI, but it includes security-sensitive installation and execution flows. The pipe-to-shell installer, dynamic binary download, PATH installation, broad infsh command execution, and X automation capabilities require strong user confirmation and safer installation guidance.
5
Files scanned
554
Lines analyzed
33
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote script directly into sh. This pattern can execute arbitrary code if the endpoint, network path, or installer content is compromised.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command repeats the curl-to-shell pattern. Reusing it for updates preserves the same arbitrary code execution risk.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command downloads a remote script and executes it with sh. That is a recognized high-risk installer pattern requiring explicit trust and verification.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The install command directly executes remotely downloaded shell content. This is a critical supply-chain risk unless users review and verify the installer before execution.
High
Broad Cloud CLI Execution Surface
The skill grants Bash(infsh *) and documents running, deploying, pulling, and tracking cloud apps. An agent using this skill can trigger remote work, read account task results, and manage apps when the user is authenticated.
The allowed-tools declaration explicitly permits all infsh subcommands, and the CLI reference includes run, task retrieval, deploy, and pull commands. This is clear capability evidence, not inferred hidden behavior.
High
Social Media Account Automation Capability
The skill includes examples and categories for posting to X, sending DMs, following users, liking posts, and retweeting. These actions can affect a user account and may enable spam or unauthorized public communication if run without confirmation.
The source directly names post, DM, follow, like, and retweet capabilities. The risk is business-logic abuse of authenticated social accounts, not a pattern-only code issue.
Capability review items (23)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command uses nested curl output and shell command substitution to choose a binary URL. If the manifest or parsing is compromised, the command can download an unintended artifact.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command installs a newly downloaded binary into a user PATH directory under the home directory. This is normal manual installation, but it creates a trusted executable on the user system.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The detected block is markdown, not Ruby execution, but it contains shell commands for remote installation and login. Those commands can change local state and authenticate a cloud CLI.
Medium
Ruby/shell backtick execution
> ```bash
The manual install block contains shell commands that download, verify, extract, and install a binary. This is legitimate setup guidance but still executes external tooling and modifies the local environment.
Medium
Ruby/shell backtick execution
| List all apps | `infsh app list` |
The table documents an infsh command to list cloud apps. It is benign discovery, but it is still external CLI execution against the service.
Medium
Ruby/shell backtick execution
| Search apps | `infsh app list --search "flux"` |
The table documents an infsh search command against the cloud app catalog. It is expected behavior but relies on external command execution.
Medium
Ruby/shell backtick execution
| Filter by category | `infsh app list --category image` |
The table documents an infsh category filter command. It is low-impact discovery, but it still invokes the external CLI.
Medium
Ruby/shell backtick execution
| Get app details | `infsh app get google/veo-3-1-fast` |
The table documents retrieving app details from inference.sh. This is legitimate use, but it performs external service access through the CLI.
Medium
Ruby/shell backtick execution
| Generate sample input | `infsh app sample google/veo-3-1-fast --save input.json` |
The command saves generated sample input to a local file. It is normal CLI use, but it causes filesystem writes and should be user-controlled.
Medium
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with an input file. It can transmit user data to a remote service and may consume account credits.
Medium
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait run command submits remote work asynchronously. It can create cloud tasks with delayed side effects or costs.
Medium
Ruby/shell backtick execution
| Check task status | `infsh task get <task-id>` |
The task command retrieves remote task status and results. This is intended behavior, but it accesses cloud account data through an external CLI.
Medium
Template literal with command substitution
> ```bash
The detected range is markdown, but it contains a shell substitution based installer flow. The security concern is dynamic command construction during binary download.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home directory path as part of installing the CLI. It is user-facing setup, but it modifies local executable state and should be explicit.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The URL is used in a remote installer command that pipes downloaded content into a shell. Hardcoded remote installer endpoints are security-sensitive because compromise of that endpoint can execute arbitrary code.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The line links to the installer script and signature tooling documentation. The URL itself is prose, but it directly supports the remote installer workflow.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from a fixed remote host as part of binary installation. This is expected setup behavior but still depends on remote artifact integrity.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command downloads a manifest from a fixed remote host and derives the binary URL from it. This network dependency affects which executable is installed.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (4)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 6, 2026, 03:40 PM
The skill is legitimate documentation for the inference.sh CLI, but it includes security-sensitive installation and execution flows. The pipe-to-shell installer, dynamic binary download, PATH installation, broad infsh command execution, and X automation capabilities require strong user confirmation and safer installation guidance.
5
Files scanned
554
Lines analyzed
33
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote script directly into sh. This pattern can execute arbitrary code if the endpoint, network path, or installer content is compromised.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command repeats the curl-to-shell pattern. Reusing it for updates preserves the same arbitrary code execution risk.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command downloads a remote script and executes it with sh. That is a recognized high-risk installer pattern requiring explicit trust and verification.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The install command directly executes remotely downloaded shell content. This is a critical supply-chain risk unless users review and verify the installer before execution.
High
Broad Cloud CLI Execution Surface
The skill grants Bash(infsh *) and documents running, deploying, pulling, and tracking cloud apps. An agent using this skill can trigger remote work, read account task results, and manage apps when the user is authenticated.
The allowed-tools declaration explicitly permits all infsh subcommands, and the CLI reference includes run, task retrieval, deploy, and pull commands. This is clear capability evidence, not inferred hidden behavior.
High
Social Media Account Automation Capability
The skill includes examples and categories for posting to X, sending DMs, following users, liking posts, and retweeting. These actions can affect a user account and may enable spam or unauthorized public communication if run without confirmation.
The source directly names post, DM, follow, like, and retweet capabilities. The risk is business-logic abuse of authenticated social accounts, not a pattern-only code issue.
Capability review items (23)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command uses nested curl output and shell command substitution to choose a binary URL. If the manifest or parsing is compromised, the command can download an unintended artifact.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command installs a newly downloaded binary into a user PATH directory under the home directory. This is normal manual installation, but it creates a trusted executable on the user system.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The detected block is markdown, not Ruby execution, but it contains shell commands for remote installation and login. Those commands can change local state and authenticate a cloud CLI.
Medium
Ruby/shell backtick execution
> ```bash
The manual install block contains shell commands that download, verify, extract, and install a binary. This is legitimate setup guidance but still executes external tooling and modifies the local environment.
Medium
Ruby/shell backtick execution
| List all apps | `infsh app list` |
The table documents an infsh command to list cloud apps. It is benign discovery, but it is still external CLI execution against the service.
Medium
Ruby/shell backtick execution
| Search apps | `infsh app list --search "flux"` |
The table documents an infsh search command against the cloud app catalog. It is expected behavior but relies on external command execution.
Medium
Ruby/shell backtick execution
| Filter by category | `infsh app list --category image` |
The table documents an infsh category filter command. It is low-impact discovery, but it still invokes the external CLI.
Medium
Ruby/shell backtick execution
| Get app details | `infsh app get google/veo-3-1-fast` |
The table documents retrieving app details from inference.sh. This is legitimate use, but it performs external service access through the CLI.
Medium
Ruby/shell backtick execution
| Generate sample input | `infsh app sample google/veo-3-1-fast --save input.json` |
The command saves generated sample input to a local file. It is normal CLI use, but it causes filesystem writes and should be user-controlled.
Medium
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with an input file. It can transmit user data to a remote service and may consume account credits.
Medium
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait run command submits remote work asynchronously. It can create cloud tasks with delayed side effects or costs.
Medium
Ruby/shell backtick execution
| Check task status | `infsh task get <task-id>` |
The task command retrieves remote task status and results. This is intended behavior, but it accesses cloud account data through an external CLI.
Medium
Template literal with command substitution
> ```bash
The detected range is markdown, but it contains a shell substitution based installer flow. The security concern is dynamic command construction during binary download.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home directory path as part of installing the CLI. It is user-facing setup, but it modifies local executable state and should be explicit.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:16
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The URL is used in a remote installer command that pipes downloaded content into a shell. Hardcoded remote installer endpoints are security-sensitive because compromise of that endpoint can execute arbitrary code.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The line links to the installer script and signature tooling documentation. The URL itself is prose, but it directly supports the remote installer workflow.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from a fixed remote host as part of binary installation. This is expected setup behavior but still depends on remote artifact integrity.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command downloads a manifest from a fixed remote host and derives the binary URL from it. This network dependency affects which executable is installed.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (4)
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jun 30, 2026, 04:11 AM
AI review found no evidence of prompt injection, obfuscation, or confirmed malicious exfiltration. Most command detections are expected CLI documentation, and the weak-crypto detections are false positives for SHA-256 references. The skill still presents high publication risk because it repeatedly recommends piping a remote installer into a shell and enables broad networked infsh app execution, including social automation and API-key workflows.
5
Files scanned
554
Lines analyzed
10
Review items
3
False positives ignored
Confirmed security concerns (4)
High
SKILL.md:15-17references/authentication.md:5-6references/authentication.md:43-44references/cli-reference.md:5-6
Remote Installer Piped to Shell
The skill recommends executing a remote installer directly through a shell. This is a real risk because a compromised endpoint, network path, or installer update could execute arbitrary code on the user machine before review.
The pipe-to-shell pattern is explicit and repeated in installation instructions. The file also provides a manual install alternative, so this appears risky rather than confirmed malicious.
High
Broad Networked CLI Execution Scope
The skill is designed to run many hosted AI applications through infsh, including image, video, search, LLM, 3D, and Twitter/X actions. This creates real risk of unintended network calls, cost consumption, generated content publication, or social account actions if commands are run without user confirmation.
The commands and capability table directly show hosted app execution and social automation. The use is central to the skill, but there is no evidence that it hides or exfiltrates data outside the named service.
Medium
references/authentication.md:27-30references/authentication.md:51-53references/cli-reference.md:68-72
API Key Handling Requires Care
The documentation instructs users to set an API key in an environment variable and notes authentication troubleshooting. This is legitimate for CLI use, but it can expose credentials through shell history, CI logs, or overly broad assistant context.
The API-key references are explicit and legitimate for authentication. Risk depends on deployment practice, so this is a moderate handling concern rather than secret theft.
Medium
Local Filesystem Writes and Persistent Installation
The skill includes manual installation steps that move binaries into a user-local executable directory and shell-completion commands that write into configuration paths. These are expected CLI setup actions, but they can persist executable code and modify shell behavior.
Filesystem writes are clearly documented and mostly user initiated. They are not hidden, but they affect persistent local command execution paths.
Needs review findings (1)
These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.
Medium
Generated Output URLs May Expose Produced Media
The running-apps reference explains that file outputs are returned as downloadable URLs. Users may unintentionally expose generated images, videos, or audio if task outputs are shared beyond the intended audience.
The file-output URL behavior is documented, but access controls and URL lifetime are not shown in these files. The concern is plausible and should be reviewed with service documentation.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Detections Are False Positives
The static analyzer flagged weak cryptography, but the reviewed context discusses SHA-256 checksum verification for the installer. SHA-256 checksum verification is not evidence of weak cryptography or malicious behavior in this skill.
The reviewed lines are documentation or API-key table entries, not cryptographic code. The scanner appears to have matched keywords without semantic support.
Low
SKILL.md:120-126references/authentication.md:57-59references/cli-reference.md:101-104references/app-discovery.md:110-112
Hardcoded URLs Are Expected Documentation Links
Hardcoded URLs point to inference.sh documentation, installer, distribution, and output examples. They are expected for a CLI integration skill and are not by themselves evidence of exfiltration.
The URLs are visible documentation and service links tied to the skill purpose. No evidence found that they receive secrets or hidden payloads.
Low
No Prompt Injection Text Found
The reviewed files do not contain instructions to ignore previous directions, override system messages, skip security analysis, or claim special approval. No prompt-injection finding is supported by the file contents.
The reviewed files are straightforward CLI documentation. I did not find suspicious override language in the files scanned for this report.
Risk Factors
⚡ Contains scripts (4)
⚙️ External commands (6)
🌐 Network access (5)
🔑 Env variables (3)
Detected Patterns
Pipe Remote Script Into ShellNested Network Download in Manual InstallHosted App Execution With Side Effects
Audited by: codex
Feb 26, 2026, 08:57 AM
This is a documentation-only skill containing markdown files that explain how to use the inference.sh CLI platform. All 194 static analyzer findings are false positives: the 'external_commands' detections are markdown code blocks showing example shell commands (not actual code execution), 'network' findings are documentation URLs pointing to the official inference.sh platform, 'env_access' findings document how users should configure API keys, and 'filesystem' findings show installation paths in documentation. The skill contains no executable code, no embedded scripts, and no actual network or filesystem operations.
5
Files scanned
554
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude