此报告尚无所请求语言的翻译，当前显示规范英文报告。

版本化安全评估

报告编号: SA-B1EF8011

9/7/2026, 3:15:07 PM

agent-tools 安全评估 v5

Skill 安全认证报告

审计历史
扫描器版本 3.0.0 审计模型: claude 最新发布的报告
技能名称
agent-tools
版本
v5
维护者
skillssh
来源
github.com/skillssh/skills/tree/main/tools/agent-tools/
覆盖范围
5 已扫描文件 · 599 分析行数
策略版本
skillstore-security-audit-policy-v1

已确认问题的最高严重性

严重

有 5 个已确认的安全问题需要处理。

安装上下文

请查看当前 Skill 详情页

本页仅汇总报告证据。Skill 详情页提供 canonical install advisory。

打开当前 Skill 详情页

本报告不会阻止或授权 manifest 或 ZIP。

The skill is primarily operational documentation for a hosted AI CLI, and most findings are safe documentation patterns. The installer pipes a remote script to a shell, reads API credentials, and uses remote manifest data in command substitution, so those findings remain confirmed; social-media posting also creates a separate business-logic risk.

报告位置

最新发布的报告

“最新”仅指报告序列，不代表 artifact 当前有效。

审计证明

有效证明

此精确报告有可公开验证的证明。

人工验证

未进行人工验证

本报告没有人工验证记录。

覆盖范围

5 已扫描文件 · 599 分析行数

有 9 项内容需要查看

局限

本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。

证据链

证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。

  1. 来源

    已绑定 commit 与路径

  2. 构件

    已绑定内容与 tree hash

  3. 审计

    已完成

  4. 安装契约

    打开 manifest 进行验证

    打开 manifest

观察到的能力

“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。

包含脚本

可能执行 Skill 随附的代码。

本次审计未记录

网络访问

可能连接外部服务。

在 17 个证据位置观察到

文件系统访问

可能读取或写入本地文件。

在 3 个证据位置观察到

环境变量

可能读取进程环境中的值。

在 3 个证据位置观察到

外部命令

可能调用 Skill 之外的命令或程序。

在 20 个证据位置观察到

能力复核项 (4)
高
references/authentication.md:30
Generic API/secret keys
export INFSH_API_KEY=your-api-key
The documentation instructs users to place an API key in an environment variable. This is a legitimate authentication mechanism, but mishandling the variable can expose a credential, so the security risk is confirmed.
高
references/authentication.md:53
Generic API/secret keys
| "API key invalid" | Check `INFSH_API_KEY` or re-login |
The documentation instructs users to place an API key in an environment variable. This is a legitimate authentication mechanism, but mishandling the variable can expose a credential, so the security risk is confirmed.
高
references/cli-reference.md:79
Generic API/secret keys
| `INFSH_API_KEY` | API key (overrides config) |
The documentation instructs users to place an API key in an environment variable. This is a legitimate authentication mechanism, but mishandling the variable can expose a credential, so the security risk is confirmed.
高
SKILL.md:28
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command parses a remote manifest inside command substitution and uses the result in a download command. This creates a supply-chain risk because remote metadata influences the artifact URL.

风险问题

已确认的安全问题与仍需审核的项目分开展示。

已确认安全问题 (5)

RISK-001 严重
references/authentication.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.
RISK-002 严重
references/authentication.md:44
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.
RISK-003 严重
references/cli-reference.md:6
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.
RISK-004 严重
SKILL.md:18
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.
RISK-005 高
SKILL.md:51-52
High-Impact Social-Media Automation
The skill demonstrates posting to Twitter through a hosted app. A mistaken prompt or compromised app could publish content using the user's account without an approval step.
The file explicitly shows a command that posts a supplied message to Twitter. This is a direct external side effect and a business-logic risk beyond generic command execution.

补救措施

本次审计记录了建议的修复措施。实施这些措施是维护者的责任。

  1. FIX-001
    严重
    The installation instructions pipe a remote script directly into a shell.
    Publish a versioned installer or package, download it first, verify a pinned checksum or signature, and then run it.
  2. FIX-002
    高
    The manual installation example uses command substitution to select a download URL from a remote manifest.
    Pin the release URL and verify its signature or checksum before extraction. Avoid parsing untrusted remote metadata in a shell command.
  3. FIX-003
    高
    The documentation instructs users to provide API keys through an environment variable.
    Document secret-manager and CI masking practices, prevent accidental logging, and explain how to rotate and revoke exposed keys.
  4. FIX-004
    高
    The skill documents posting and other social-media actions through hosted apps.
    Require explicit user confirmation, narrow permissions, preview content, and apply rate limits before any post, message, follow, like, or retweet.

专家证据

不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。

Artifact 主体

Marketplace 提交
b1ef80115e869b66867d4eac8e3c8dc56a393a8d
内容哈希
d8b08ea6590fc379fb686852c39ff06829f2a31a9c8b27333849bc41e152573d
目录树哈希
450bc31ec3451188ce03801ef820f0db86e2d70b911e8ecbd9f92c8801748703
Skill 路径
skills/skillssh/agent-tools
审计载荷哈希
3ddc07b4277855f241f91a407fb360a1

分析元数据

审计模型: claude

分析状态: 已完成

范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。

验证与导出

JSON 报告 已签名审计证明 CITATION.cff SARIF 2.1.0 已签名安装清单 来源

manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。

审计证明: active