📦
remotion-render
69Render React Animations as MP4 Videos
Teams need reliable videos from React animation code without manual export work. This skill sends Remotion TSX to inference.sh and returns an MP4 render.
Design & Creative View
Skills infsh-cli
📦
infsh-cli
Content revision r1 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands
Run AI Apps with the inference.sh CLI
Teams need one interface for many hosted AI models and media tools. This skill helps agents discover, run, and monitor inference.sh apps from the CLI.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "infsh-cli" from https://skillstore.io/skills/skillssh-infsh-cli.md and its manifest at https://skillstore.io/api/skills/skillssh-infsh-cli/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "infsh-cli". Find a strong image app for product photography.
Expected outcome:
- Recommended FLUX and Gemini image apps with short reasons.
- Listed the main input fields needed for each app.
- Suggested generating a sample input before running a paid job.
Using "infsh-cli". Run a long video job and check it later.
Expected outcome:
- Selected a video app and confirmed the prompt with the user.
- Submitted the job in no-wait mode.
- Returned the task identifier and later summarized the completed result.
Using "infsh-cli". Use a local image as source media.
Expected outcome:
- Confirmed the exact local file path before upload.
- Explained that the file would be sent to a cloud app.
- Reported the returned media link after the task completed.
Security Audit
Criticalv5 • 7/7/2026 Open versioned report
The audit confirms critical remote-installer guidance that pipes downloaded content directly into a shell. Most API-key, documentation-link, shell-completion, and Markdown backtick findings are false positives, but the skill still performs real external CLI work. No prompt injection evidence was found in the reviewed files.
5
Files scanned
596
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documentation instructs users to pipe a remote script directly into a shell. This can execute changed or compromised remote content without prior inspection.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documentation instructs users to pipe a remote script directly into a shell. This can execute changed or compromised remote content without prior inspection.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documentation instructs users to pipe a remote script directly into a shell. This can execute changed or compromised remote content without prior inspection.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documentation instructs users to pipe a remote script directly into a shell. This can execute changed or compromised remote content without prior inspection.
High
Automatic Local File Uploads to Cloud Apps
The docs state that the CLI automatically uploads local files when a path is supplied. This can expose sensitive files without careful confirmation.
Both cited sections explicitly describe automatic local file uploads and show local path inputs. The risk is clear, although user intent is still required.
Medium
Twitter/X Account Automation
The skill documents posting tweets, creating posts with media, and related Twitter/X actions. These commands can perform account actions through connected credentials.
The cited lines explicitly list post, media, DM, follow, like, and retweet capabilities. The finding is about authorized account actions, not hidden abuse.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
The span contains shell commands including a remote installer and login command. Even though the backticks are Markdown, the instructions can cause external command execution.
Medium
Ruby/shell backtick execution
> ```bash
The manual install block includes curl, checksum, archive extraction, and moving a binary into PATH. These are real shell operations if followed.
Medium
Ruby/shell backtick execution
```bash
The examples run infsh commands against cloud AI apps and include a Twitter post action. These are external operations even when expected for the skill.
Medium
Ruby/shell backtick execution
```bash
The command block runs infsh apps with local file paths and media inputs. Those commands can upload local files to external cloud services.
Medium
Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with an input file. That is an intentional external operation and may transmit prompt or file data.
Medium
Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The command submits a cloud app run without waiting. It can start external work and should require clear user intent.
Medium
Ruby/shell backtick execution
```bash
The related-skills block suggests npx commands that install additional skills. This can expand the executable instruction surface if followed automatically.
Medium
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The install command uses shell command substitution to derive a download URL from remote metadata. This is a real shell expansion pattern in installation guidance.
Medium
Template literal with command substitution
> ```bash
The manual install block includes a command substitution inside a download command. It is shell guidance rather than a template literal, but the risky expansion is present.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used by a remote installer command, so users fetch code from an external host. The separate pipe-to-shell finding captures the execution risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used by a remote installer command, so users fetch code from an external host. The separate pipe-to-shell finding captures the execution risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used by a remote installer command, so users fetch code from an external host. The separate pipe-to-shell finding captures the execution risk.
Low
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is used by a remote installer command, so users fetch code from an external host. The separate pipe-to-shell finding captures the execution risk.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install flow downloads release artifacts or metadata from inference.sh distribution hosts. This is expected but still a real remote download dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install flow downloads release artifacts or metadata from inference.sh distribution hosts. This is expected but still a real remote download dependency.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (20)
Detected Patterns
Pipe to shell pattern×4
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/skillssh-infsh-cli/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/skillssh-infsh-cli?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/skillssh-infsh-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skillssh-infsh-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/skillssh-infsh-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
skillssh. (2026). infsh-cli security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skillssh-infsh-cli/audits/5BibTeX citation
@techreport{skillssh-skillssh-infsh-cli-2026,
author = {skillssh},
title = {infsh-cli security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/skillssh-infsh-cli/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "infsh-cli security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "skillssh"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/skillssh-infsh-cli/audits/5"
identifiers:
- type: other
value: "skillstore:skillssh-infsh-cli:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
9 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
inferen-sh Recommended
inferen-sh-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 75
Updated
2026-09-09
qu-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 51
Updated
2026-09-09
tool-belt-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 46
Updated
2026-09-09
skillssh Current
skillssh-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 41
Updated
2026-09-09
inference-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 41
Updated
2026-09-09
infsh-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 40
Updated
2026-09-09
inference-sh-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 40
Updated
2026-09-09
halt-catch-fire-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 31
Updated
2026-09-09
101-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 5
Updated
2026-09-09
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
68
Community
91
Spec Compliance
What You Can Build
Prototype AI Workflows
Find available models, inspect input schemas, run sample jobs, and compare results before integrating an API.
Create Media Assets
Generate images, videos, avatars, audio, and 3D assets from prompts or approved local source files.
Operate Hosted AI Jobs
Submit long-running jobs, track task status, save outputs, and coordinate repeatable CLI-based AI operations.
Try These Prompts
Find an App
Use infsh-cli to find image generation apps for realistic product photos. Show the best options and explain required inputs.
Run a Simple Job
Use infsh-cli to run a text-to-image job for a clean product mockup. Confirm the app and input before running it.
Track a Long Job
Use infsh-cli to start a video generation job without waiting. Then check the task status and summarize the result.
Compare Model Options
Use infsh-cli to compare three LLM or search apps for a research workflow. Include schema differences, strengths, and limits.
Best Practices
- Inspect app schemas before running jobs with complex inputs.
- Confirm every local file path before upload to a cloud app.
- Use no-wait mode for long media jobs and track task status separately.
Avoid
- Do not run installer commands without verifying the source and checksum.
- Do not upload broad directories or sensitive local files by default.
- Do not post, follow, like, retweet, or send messages without explicit approval.
Frequently Asked Questions
What does this skill help with?
It helps agents use the infsh CLI to discover, run, and monitor hosted AI apps.
Does it require an account?
Yes. You need an inference.sh account and either CLI login or an INFSH_API_KEY value.
Can it generate images and videos?
Yes. The references include image, video, avatar, audio, 3D, and utility app examples.
Can it use local files?
Yes. Supported apps can accept local file paths, which the CLI uploads to the cloud.
Can it automate Twitter or X?
Yes, but account actions should require explicit user approval before execution.
Is it safe to install automatically?
The audit flagged pipe-to-shell installer guidance. Users should verify downloads and signatures before installation.
Developer Details
Author
skillsshLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
f93e9bb0daca99badb6a7e574b97737155d57cb3
Maintenance freshness
7/18/2026
Usage
3 downloads · 92 views
File structure
More from skillssh
View all📦
web-search
50Search and Extract Web Sources
Research tasks need current sources and clean page text. This skill routes search, answers, and extraction through Tavily and Exa apps.
Research & Learning View
📦
ai-video-generation
50Create AI Videos with Multiple Models
Choosing and invoking video models can be complex. This skill provides model guidance and belt CLI examples for generation, animation, editing, lipsync, sound, and upscaling.
Design & Creative View
📦
twitter-automation
50Automate Twitter/X Posts and Engagement
Manual Twitter/X posting and engagement can slow campaign work. This skill uses inference.sh CLI apps to run approved posting, media, and engagement tasks.
Communication View
📦
python-executor
38Run Python Code in a Sandbox
Agents often need Python execution without managing local packages. This skill runs scripts through inference.sh with common data, web, media, and document libraries.
Coding & Development View
📦
agent-browser
38Automate Browser Tasks with Agent Browser
Manual web interaction slows research, testing, and data collection. This skill controls hosted browser sessions with structured navigation, actions, extraction, and visual capture.
Productivity View
Related Skills
View all📦
building-plugins
83Build Claude Code Plugins
by C0ntr0lledCha0s
Creating Claude Code plugins requires correct structure, validation, documentation, and safe packaging. This skill guides users through plugin architecture, templates, validation, and publishing workflows.
DevOps & Infrastructure View
📦
building-hooks
83Build Claude Code Automation Hooks
by C0ntr0lledCha0s
Claude Code hooks can automate checks, formatting, and policy enforcement, but unsafe hook scripts can affect local files or commands. This skill guides users through structured hook design, validation, and maintenance.
DevOps & Infrastructure View
📦
writing-hookify-rules
82Write Hookify Rules for Claude Code
by anthropics
Hook rules can be hard to write correctly across bash, file, stop, and prompt events. This skill gives Claude, Codex, and Claude Code practical guidance for creating and testing Hookify rules.
DevOps & Infrastructure View
📦
homeassistant-config
81Build Home Assistant YAML Faster
by ESJavadex
Home Assistant YAML is easy to break when automations, secrets, and dashboards grow. This skill provides patterns, examples, and local validators for safer configuration work.
DevOps & Infrastructure View
📦
wp-wpcli-and-ops
81Manage WordPress Safely with WP-CLI
by Automattic
WordPress command-line operations can damage data or affect the wrong site. This skill provides guarded workflows for inspection, changes, automation, and verification.
DevOps & Infrastructure View
📦
linear-projects-write
81Create and Update Linear Projects from the CLI
by Bind
Managing Linear projects through the web interface is slow when you work in the terminal or automate workflows. This skill lets you create and update projects with simple commands, so you can manage project data directly from scripts and the command line.
Productivity View