Versioned security assessment

Report ID: SA-F477E37D

6/30/2026, 10:14:02 PM

infsh-cli security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
infsh-cli
Version
v2
Maintainer
tool-belt
Source
github.com/tool-belt/skills/tree/main/tools/infsh-cli/
Coverage
5 Files scanned · 596 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static findings are mostly markdown examples for a CLI skill, so many Ruby/backtick and weak-crypto matches are false positives from command formatting and SHA-256 checksum text. Confirmed risks remain high because the skill documents a curl-to-shell installer, cloud execution through infsh, API key handling, automatic local file uploads, and Twitter/X automation. No prompt injection attempt or confirmed malicious intent was found, so the skill is not blocked.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 596 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 30 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 144 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 High
SKILL.md:15-17references/authentication.md:5-6references/cli-reference.md:5-6
Remote Shell Installer Instruction
The skill tells users to install or update the CLI with curl piped directly to sh. This is a true positive because it executes network-delivered shell code before local inspection, creating supply-chain and endpoint compromise risk if the host, transport, or script is compromised.
The exact pipe-to-shell install pattern appears in multiple installation sections. The skill provides a manual install alternative, but the primary instruction still asks users to execute remote code.
RISK-002 High
SKILL.md:56-71references/running-apps.md:21-42
Cloud CLI Can Upload Local Files and Run External Apps
The skill explains that local paths are automatically uploaded when passed as app inputs. This is a true positive for filesystem and network risk because user files can leave the local machine through cloud app execution, including media used for image, video, avatar, and social posting workflows.
The documentation explicitly states that local files are uploaded and shows absolute, relative, and home-directory paths. This is expected functionality, but it is a material data exposure risk.
RISK-003 Medium
SKILL.md:4references/cli-reference.md:19-66references/running-apps.md:3-18
Broad External Command Surface Through infsh
The external command findings are true positives in context because the skill is designed to make the agent run infsh commands. The allowed tool scope limits execution to infsh, but that CLI can list apps, run cloud jobs, deploy apps, pull app source, save outputs, and check tasks.
The command surface is documented clearly and is central to the skill. The risk is moderated because commands are examples for the named CLI rather than arbitrary shell snippets.
RISK-004 Medium
references/authentication.md:25-33references/authentication.md:49-53references/cli-reference.md:68-72
API Key Handling Requires Secret Hygiene
The env_access findings are true positives because the documentation instructs users to set INFSH_API_KEY and troubleshoot invalid API keys. This is legitimate authentication guidance, but users must avoid exposing the key in prompts, logs, shell history, or shared CI output.
The named API key environment variable is present and used for authentication. No evidence shows exfiltration, so this is a handling risk rather than confirmed abuse.
RISK-005 Medium
SKILL.md:49-50SKILL.md:96references/running-apps.md:35-36
Social Media Automation Can Perform Account Actions
The skill documents Twitter/X actions such as posting, creating posts with media, direct messages, follows, likes, and reposts. This is legitimate automation, but it can cause unauthorized or unintended external side effects if used without explicit user confirmation.
The examples and capability table explicitly include Twitter/X posting and other account actions. The risk is semantic and side-effect based, not hidden malicious behavior.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
references/app-discovery.md:5-82references/cli-reference.md:11-66references/running-apps.md:3-18
Static Markdown Command Examples Overstated as Code Execution
Many external command and Ruby backtick findings are false positives because they are markdown inline-code examples or fenced bash examples in reference documentation. They describe intended CLI usage and do not by themselves execute during skill loading.
The referenced lines are documentation tables and code fences, not executable source files. They can still guide an agent to run commands, which is covered by separate findings.
Low
SKILL.md:7-11SKILL.md:136-144references/authentication.md:55-59
Hardcoded Documentation URLs Are Expected
The hardcoded URL findings are mostly links to inference.sh documentation, installer, distribution assets, and an image. These are expected for a CLI documentation skill and are not evidence of hidden exfiltration by themselves.
The URLs are visible user-facing documentation and installer links. No evidence found that the skill secretly sends data to unrelated endpoints.
Low
SKILL.md:20-28references/app-discovery.md:88-105references/cli-reference.md:89-97
Weak Cryptography Scanner Hits Are Checksum References
The weak cryptographic algorithm findings appear to come from SHA-256 checksum instructions and model or app names, not from implemented cryptographic code. No evidence found of MD5, SHA-1, custom encryption, or insecure cryptographic implementation in the reviewed files.
The relevant visible cryptographic text describes SHA-256 verification for downloads, which is not a weak algorithm finding. Some scanner line references map to app names rather than crypto logic.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable