Versioned security assessment

Report ID: SA-2C2BB33F

6/30/2026, 4:11:22 AM

agent-tools security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: agent-tools
Version: v2
Maintainer: inference-sh-9
Source: github.com/inference-sh-9/skills/tree/main/skills/agent-tools/
Coverage: 5 Files scanned · 554 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

AI review found no evidence of prompt injection, obfuscation, or confirmed malicious exfiltration. Most command detections are expected CLI documentation, and the weak-crypto detections are false positives for SHA-256 references. The skill still presents high publication risk because it repeatedly recommends piping a remote installer into a shell and enables broad networked infsh app execution, including social automation and API-key workflows.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 554 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 6 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High

SKILL.md:15-17 references/authentication.md:5-6 references/authentication.md:43-44 references/cli-reference.md:5-6

Remote Installer Piped to Shell

The skill recommends executing a remote installer directly through a shell. This is a real risk because a compromised endpoint, network path, or installer update could execute arbitrary code on the user machine before review.

The pipe-to-shell pattern is explicit and repeated in installation instructions. The file also provides a manual install alternative, so this appears risky rather than confirmed malicious.

RISK-002 High

SKILL.md:36-50 SKILL.md:71-79 references/running-apps.md:111-116

Broad Networked CLI Execution Scope

The skill is designed to run many hosted AI applications through infsh, including image, video, search, LLM, 3D, and Twitter/X actions. This creates real risk of unintended network calls, cost consumption, generated content publication, or social account actions if commands are run without user confirmation.

The commands and capability table directly show hosted app execution and social automation. The use is central to the skill, but there is no evidence that it hides or exfiltrates data outside the named service.

RISK-003 Medium

references/authentication.md:27-30 references/authentication.md:51-53 references/cli-reference.md:68-72

API Key Handling Requires Care

The documentation instructs users to set an API key in an environment variable and notes authentication troubleshooting. This is legitimate for CLI use, but it can expose credentials through shell history, CI logs, or overly broad assistant context.

The API-key references are explicit and legitimate for authentication. Risk depends on deployment practice, so this is a moderate handling concern rather than secret theft.

RISK-004 Medium

SKILL.md:23-31 references/cli-reference.md:76-84

Local Filesystem Writes and Persistent Installation

The skill includes manual installation steps that move binaries into a user-local executable directory and shell-completion commands that write into configuration paths. These are expected CLI setup actions, but they can persist executable code and modify shell behavior.

Filesystem writes are clearly documented and mostly user initiated. They are not hidden, but they affect persistent local command execution paths.

Needs review findings (1)

REVIEW-001 Medium

references/running-apps.md:119-129

Generated Output URLs May Expose Produced Media

The running-apps reference explains that file outputs are returned as downloadable URLs. Users may unintentionally expose generated images, videos, or audio if task outputs are shared beyond the intended audience.

The file-output URL behavior is documented, but access controls and URL lifetime are not shown in these files. The concern is plausible and should be reviewed with service documentation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)

Low

SKILL.md:20-28 references/authentication.md:33 references/cli-reference.md:68-72

Weak Cryptography Detections Are False Positives

The static analyzer flagged weak cryptography, but the reviewed context discusses SHA-256 checksum verification for the installer. SHA-256 checksum verification is not evidence of weak cryptography or malicious behavior in this skill.

The reviewed lines are documentation or API-key table entries, not cryptographic code. The scanner appears to have matched keywords without semantic support.

Low

SKILL.md:120-126 references/authentication.md:57-59 references/cli-reference.md:101-104 references/app-discovery.md:110-112

Hardcoded URLs Are Expected Documentation Links

Hardcoded URLs point to inference.sh documentation, installer, distribution, and output examples. They are expected for a CLI integration skill and are not by themselves evidence of exfiltration.

The URLs are visible documentation and service links tied to the skill purpose. No evidence found that they receive secrets or hidden payloads.

Low

SKILL.md:1-5 references/app-discovery.md:1-3 references/running-apps.md:1-3

No Prompt Injection Text Found

The reviewed files do not contain instructions to ignore previous directions, override system messages, skip security analysis, or claim special approval. No prompt-injection finding is supported by the file contents.

The reviewed files are straightforward CLI documentation. I did not find suspicious override language in the files scanned for this report.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable