Versioned security assessment

Report ID: SA-4121DE96

8/6/2026, 11:37:57 AM

agent-tools security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
agent-tools
Version
v5
Maintainer
infsh-skills
Source
github.com/infsh-skills/skills/tree/main/tools/agent-tools/
Coverage
5 Files scanned · 599 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill repeatedly recommends downloading and piping an external installer into sh, creating a critical supply-chain execution risk. Its manual installation builds a download URL from a remote manifest, while local files and social actions can leave the user's environment. Most remaining detections are Markdown formatting, placeholder credential documentation, standard user directories, or expected first-party links.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 599 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 20 evidence locations

Capability review items (3)
High
SKILL.md:28
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command derives curl's download argument from a mutable remote manifest through shell substitution. Compromise or malformed output could redirect artifact retrieval before later installation.
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Although the backticks are Markdown formatting, the enclosed npx instruction executes an external package installer. Running an unpinned package introduces a supply-chain and environment-modification risk.
Low
SKILL.md:13
Hardcoded URL
![[inference.sh](https://inference.sh)](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The Markdown embeds a remote image hosted on cloud.inference.sh, which may trigger a viewer network request and disclose request metadata. Actual exposure depends on the marketplace renderer.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
references/authentication.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads mutable remote content and executes it directly with sh. A compromised endpoint or delivery path would provide immediate code execution under the user's account.
RISK-002 Critical
references/authentication.md:44
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall instruction again executes a remote script without giving the user an inspection or pinning step. Endpoint compromise would become local shell execution.
RISK-003 Critical
references/cli-reference.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command sends unpinned network content directly to sh. This creates a critical software supply-chain execution path.
RISK-004 Critical
SKILL.md:18
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary installation instructions execute downloaded remote content immediately through sh. This grants the remote endpoint code execution with the user's privileges.
RISK-005 Medium
SKILL.md:58-73references/running-apps.md:21-42
Automatic Local File Uploads
Local paths supplied to supported app fields are automatically uploaded to the hosted service. Without explicit confirmation, an agent could transmit sensitive local media or documents.
Both files explicitly state that the CLI automatically uploads local files and provide absolute, relative, and home-directory path examples.
RISK-006 Medium
SKILL.md:51-52SKILL.md:98references/running-apps.md:35-36
Consequential Social Media Actions
The skill can publish posts and perform other account actions through hosted X apps. It does not require a user confirmation immediately before these external side effects.
The cited lines explicitly demonstrate posting with local media and list posting, direct-message, follow, like, and retweet capabilities.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer content is piped directly into sh.
    Replace every pipe-to-shell instruction with a version-pinned download, checksum and signature verification, user inspection, then explicit execution.
  2. FIX-002
    High
    The manual installer derives an artifact URL through shell substitution.
    Use a structured manifest parser, validate the scheme and host, quote the resolved URL, and pin the artifact version before downloading.
  3. FIX-003
    Medium
    Local file paths are automatically uploaded to a hosted service.
    Require explicit confirmation before each upload, display the resolved path and destination, and reject sensitive or unexpected paths by default.
  4. FIX-004
    Medium
    Social media commands can create immediate public or account-level side effects.
    Require a final confirmation that shows the account, action, content, and attached files before posting or changing account state.
  5. FIX-005
    Medium
    The skill recommends an unpinned npx package installation.
    Pin the package version or immutable source revision and require user approval before installing the related skill.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
4121de961d1b6f2ffca856260e239505c302452c
Content hash
d8b08ea6590fc379fb686852c39ff06829f2a31a9c8b27333849bc41e152573d
Tree hash
450bc31ec3451188ce03801ef820f0db86e2d70b911e8ecbd9f92c8801748703
Skill path
skills/infsh-skills/agent-tools
Audit payload hash
45ca30b8e4906b7007420d7392bed121

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active