The skill appears to be a legitimate Remotion rendering workflow, but it depends on the inference.sh CLI and cloud renderer. The quick start includes a curl-to-shell installer, which is a confirmed critical supply-chain risk. Most Markdown backtick detections are false positives, while CLI examples and remote rendering remain real trust boundaries.
curl -fsSL https://cli.inference.sh | sh && infsh login
The quick start instructs users to run curl -fsSL https://cli.inference.sh piped into sh. That executes a remote script directly and is a critical supply-chain risk.
The skill sends Remotion TSX component code and props to inference.sh for cloud rendering, which may expose proprietary code or sensitive data.
The examples show TSX code and input props being passed to infsh/remotion-render. The service is explicitly described as inference.sh-based rendering, so the data leaves the local environment.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This range includes shell examples for installing the CLI and running infsh. The curl-to-shell portion is handled by the blocker finding, but the external command exposure is real.
Render videos from React/Remotion component code via [inference.sh](https://inference.sh) CLI.
The text states rendering is performed through the inference.sh CLI, so the workflow depends on an external service. This is expected but creates a real network trust boundary.
The skill appears to be a legitimate Remotion rendering workflow, but it depends on the inference.sh CLI and cloud renderer. The quick start includes a curl-to-shell installer, which is a confirmed critical supply-chain risk. Most Markdown backtick detections are false positives, while CLI examples and remote rendering remain real trust boundaries.
curl -fsSL https://cli.inference.sh | sh && infsh login
The quick start instructs users to run curl -fsSL https://cli.inference.sh piped into sh. That executes a remote script directly and is a critical supply-chain risk.
The skill sends Remotion TSX component code and props to inference.sh for cloud rendering, which may expose proprietary code or sensitive data.
The examples show TSX code and input props being passed to infsh/remotion-render. The service is explicitly described as inference.sh-based rendering, so the data leaves the local environment.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
This range includes shell examples for installing the CLI and running infsh. The curl-to-shell portion is handled by the blocker finding, but the external command exposure is real.
Render videos from React/Remotion component code via [inference.sh](https://inference.sh) CLI.
The text states rendering is performed through the inference.sh CLI, so the workflow depends on an external service. This is expected but creates a real network trust boundary.
Static findings for external commands and network access are mostly true positives because the skill instructs users to install and run the inference.sh CLI. The remote shell installer is a confirmed high-risk supply-chain pattern, but I found no evidence of prompt injection or confirmed malicious intent in SKILL.md.
1
Files scanned
210
Lines analyzed
6
Review items
2
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
TRUE_POSITIVE: The quick start instructs users to pipe a network download directly into sh. This can execute changed or compromised remote installer content before the user can inspect it.
The command pattern is explicit and semantically confirmed by the install instructions. The file later describes checksum verification, but the piped shell path still runs remote code directly.
TRUE_POSITIVE: The skill permits Bash execution for infsh and provides several infsh app run examples. This is core functionality, but it increases risk because model-assisted sessions can run external commands.
The external command surface is clearly present and intended. The examples use a named CLI rather than arbitrary shell construction, so the risk is elevated but not automatically malicious.
TRUE_POSITIVE: The skill sends React and Remotion source code, props, and render settings to inference.sh for processing. Users could expose proprietary video logic or sensitive data in props.
The network processing behavior is documented as the skill's purpose. It is legitimate for this skill, but the privacy and data exposure risk is real.
TRUE_POSITIVE: The related skills section tells users to run npx skills add commands for multiple external packages. This expands the supply-chain surface beyond the audited single skill file.
The commands are visible and relevant to package installation. They may be normal documentation, but they ask users to fetch additional unaudited content.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
FALSE_POSITIVE: The hardcoded Remotion and inference.sh URLs are documentation references. I did not find evidence that these links exfiltrate data by themselves.
The URLs appear in a documentation list and do not include encoded local data or secrets. The broader service dependency is covered separately.
FALSE_POSITIVE: The weak cryptography alert appears to match a checksum reference. SHA-256 checksum verification is not a weak algorithm indicator in this context.
Line 29 explicitly describes SHA-256 checksum verification for downloads. I did not find MD5, SHA-1, or custom cryptographic code in the reviewed file.
Static analysis detected 31 external command patterns and 8 network URLs, but all are FALSE POSITIVES. The skill uses the infsh CLI with proper allowed-tools constraints (Bash(infsh *)). External commands are intentional platform integration, not arbitrary execution. Network URLs point to legitimate service endpoints. Weak crypto finding triggered by SHA-256 documentation reference (SHA-256 is secure). Pipe-to-shell on line 17 is optional user-run CLI installation, not skill-executed code.
1
Files scanned
210
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Documentation includes curl | sh installation pattern on line 17. This is a user-run command for CLI setup, not code executed by the skill. The pattern downloads from the official inference.sh domain and verifies SHA-256 checksums.