Versioned security assessment

Report ID: SA-36E07D5E

7/7/2026, 8:10:15 AM

infsh-cli security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
infsh-cli
Version
v3
Maintainer
tool-belt
Source
github.com/tool-belt/skills/tree/main/tools/infsh-cli/
Coverage
5 Files scanned · 596 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown examples for a CLI skill and were false positives, including API key placeholders, documentation links, shell completion paths, and app command tables. Confirmed risks are the repeated curl-to-shell installer, command-substitution download flow, installation of a downloaded binary into PATH, automatic local file uploads to cloud apps, and Twitter/X automation side effects. No prompt injection attempt or overt malicious instruction was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 596 Lines analyzed

17 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 19 evidence locations

Capability review items (11)
High
SKILL.md:31
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual installer moves a downloaded binary into ~/.local/bin, a PATH location in the user home directory. This is legitimate setup, but it can create persistence for a compromised binary.
Medium
SKILL.md:26
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual installer evaluates command substitution from a remote manifest and passes the selected URL to curl. If the manifest or parsing is compromised, the user may download an unintended binary.
Medium
SKILL.md:23-32
Template literal with command substitution
> ```bash
The label is imprecise, but this block contains shell command substitution for a manual binary download. The pattern is security-sensitive because remote manifest content influences the downloaded artifact.
Medium
SKILL.md:31
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The hidden home-directory path is used to install an executable that future shells may run. The intent is normal installation, but the operation is security-sensitive.
Low
references/authentication.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This URL is used in a command that fetches a remote installer for shell execution. The endpoint is expected, but it is still a security-sensitive network dependency.
Low
references/authentication.md:44
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This URL is used in a command that fetches a remote installer for shell execution. The endpoint is expected, but it is still a security-sensitive network dependency.
Low
references/cli-reference.md:6
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This URL is used in a command that fetches a remote installer for shell execution. The endpoint is expected, but it is still a security-sensitive network dependency.
Low
SKILL.md:16
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
This URL is used in a command that fetches a remote installer for shell execution. The endpoint is expected, but it is still a security-sensitive network dependency.
Low
SKILL.md:20
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
This link points to the same remote install script described by the curl-to-shell instructions. It is expected documentation, but it supports a security-sensitive installer flow.
Low
SKILL.md:25
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install downloads checksum metadata from a fixed external distribution host. This is an expected dependency, but integrity relies on that remote source.
Low
SKILL.md:26
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manifest URL is fetched during manual installation and influences which binary is downloaded. This is a real supply-chain dependency even though the host is expected.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
references/authentication.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The documentation tells users to pipe a remote HTTPS script directly into sh. If that endpoint or delivery path is compromised, arbitrary installer code can execute without prior review.
RISK-002 Critical
references/authentication.md:44
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall instructions repeat the same remote curl-to-shell pattern. This is a confirmed critical installation risk even if the service is legitimate.
RISK-003 Critical
references/cli-reference.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The CLI reference includes a remote installer piped directly into sh. This can execute arbitrary code from the installer endpoint before the user can inspect it.
RISK-004 Critical
SKILL.md:16
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install path pipes a remote script directly to sh. This is a confirmed critical pattern because arbitrary installer code can run without local review.
RISK-005 High
SKILL.md:56-71references/running-apps.md:21-37
Automatic Local File Upload to Cloud Services
The skill states that the CLI automatically uploads local files when a path is provided instead of a URL. This can disclose local media or documents to external apps if commands run without confirmation.
Both cited sections explicitly say local file paths are automatically uploaded and show media file examples. The capability is intentional, but it is a clear data disclosure risk.
RISK-006 Medium
SKILL.md:49-50SKILL.md:96
External Social Media Account Actions
The skill documents X/Twitter apps for posting tweets, media posts, direct messages, following, liking, and retweeting. These commands can change a connected account state and publish user-visible content.
The cited lines show a post-tweet example and list X automation actions. These are explicit external side effects, not inferred behavior.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly to sh.
    Replace curl-to-shell install commands with reviewed manual installation, pinned checksums, signature verification, and explicit user confirmation.
  2. FIX-002
    High
    Downloaded binary is moved into a user PATH directory.
    Explain the install location, verify checksums and signatures before moving the binary, and offer package-manager options.
  3. FIX-003
    High
    Local paths can upload user files to cloud apps.
    Require explicit confirmation before commands that send local files, and warn about sensitive directories and private media.
  4. FIX-004
    Medium
    Manual install uses shell command substitution from a remote manifest.
    Provide direct per-platform download links or an audited installer that validates manifest data before download.
  5. FIX-005
    Medium
    Twitter/X automation can publish or modify account state.
    Require user approval before posting, sending direct messages, following, liking, or retweeting.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable