Most static external-command alerts are false positives caused by Markdown code fences and inline code spans. The skill intentionally grants Bash(infsh *) and sends prompts or media URLs through inference.sh. No prompt injection or credential exfiltration language was found.
The skill allows Bash(infsh *) and directs users to run inference.sh video apps. Prompts and media URLs may leave the user environment.
The allowed-tools declaration grants broad infsh execution, and the quick start shows an app run. This is intended, but it creates data disclosure and account-use risk.
The related skills section recommends npx skills add commands for other skills. Those commands can expand the execution surface beyond this audit.
The install commands are visible in the file, but the skill allowed tools do not include npx. The risk depends on a user or agent choosing to run them.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill links to mutable install instructions on raw.githubusercontent.com. It is not automatic execution, but it sends users outside the audited content.
Most static external-command alerts are false positives caused by Markdown code fences and inline code spans. The skill intentionally grants Bash(infsh *) and sends prompts or media URLs through inference.sh. No prompt injection or credential exfiltration language was found.
The skill allows Bash(infsh *) and directs users to run inference.sh video apps. Prompts and media URLs may leave the user environment.
The allowed-tools declaration grants broad infsh execution, and the quick start shows an app run. This is intended, but it creates data disclosure and account-use risk.
The related skills section recommends npx skills add commands for other skills. Those commands can expand the execution surface beyond this audit.
The install commands are visible in the file, but the skill allowed tools do not include npx. The risk depends on a user or agent choosing to run them.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill links to mutable install instructions on raw.githubusercontent.com. It is not automatic execution, but it sends users outside the audited content.
Static analysis reported high risk because Markdown command examples, code spans, and sample URLs matched broad dangerous-pattern rules. Review found no prompt injection, executable Ruby code, weak cryptography, or credential exfiltration code. The skill is publishable with warnings because it intentionally guides users to run infsh commands and send prompts or media URLs to remote services.
1
Files scanned
186
Lines analyzed
6
Review items
2
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill provides many Bash examples that run infsh app commands. This is intended behavior, but users should approve commands and avoid untrusted shell interpolation.
The commands are visible Markdown examples and match the skill purpose. The risk is real because running them invokes a local CLI with user-provided media prompts.
The examples send prompts, image URLs, audio URLs, and video URLs to inference.sh model apps. Private or licensed media could leave the local environment.
The referenced inputs are explicit URL fields passed to remote generation apps. This is legitimate for the skill, but it has clear privacy and data handling impact.
The documentation includes npx skills add commands for related community skills. Users who copy them may install additional code outside this skill review.
The commands are documentation examples and are not automatically executed. Supply-chain risk remains because they install additional skills from a community source.
The hardcoded URL findings are documentation links, an image preview, and placeholder media URLs. No evidence found of credential exfiltration or tracking logic.
The URLs are readable Markdown links or sample input values. They support the documented workflow and do not include secret collection code.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static analysis reported high risk because Markdown command examples, code spans, and sample URLs matched broad dangerous-pattern rules. Review found no prompt injection, executable Ruby code, weak cryptography, or credential exfiltration code. The skill is publishable with warnings because it intentionally guides users to run infsh commands and send prompts or media URLs to remote services.
1
Files scanned
186
Lines analyzed
6
Review items
2
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill provides many Bash examples that run infsh app commands. This is intended behavior, but users should approve commands and avoid untrusted shell interpolation.
The commands are visible Markdown examples and match the skill purpose. The risk is real because running them invokes a local CLI with user-provided media prompts.
The examples send prompts, image URLs, audio URLs, and video URLs to inference.sh model apps. Private or licensed media could leave the local environment.
The referenced inputs are explicit URL fields passed to remote generation apps. This is legitimate for the skill, but it has clear privacy and data handling impact.
The documentation includes npx skills add commands for related community skills. Users who copy them may install additional code outside this skill review.
The commands are documentation examples and are not automatically executed. Supply-chain risk remains because they install additional skills from a community source.
The hardcoded URL findings are documentation links, an image preview, and placeholder media URLs. No evidence found of credential exfiltration or tracking logic.
The URLs are readable Markdown links or sample input values. They support the documented workflow and do not include secret collection code.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
All 66 static analysis findings were evaluated and determined to be false positives. The scanner incorrectly flagged markdown code fences (triple-backtick blocks) as Ruby/shell backtick execution. Hardcoded URLs are legitimate documentation links and example placeholders. The two high-severity weak cryptography findings are false positives with no cryptographic content present at the reported locations. The skill legitimately requires external command execution (infsh CLI) and network access (inference.sh API), which are documented risk factors but present no security concern for a CLI-based video generation tool. No prompt injection or malicious intent detected.