Skills agent-tools Audit History v3 This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-30C73EAC
7/5/2026, 3:12:03 PM
agent-tools security assessment v3 Skill Security Certification Report
Audit History Audit model: codex Historical report
Skill name agent-tools
Version v3
Maintainer inf-sh
Coverage 5 Files scanned · 540 Lines analyzed
Policy version Unavailable Highest confirmed finding severity
Critical 6 confirmed security findings require attention.
Installation context
Historical evidence This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill page This report does not block or authorize the manifest or ZIP.
The skill is legitimate CLI documentation for inference.sh, but it includes confirmed remote shell installer instructions and many external infsh commands. Most hardcoded documentation links and API-key mentions are false positives, while cloud execution and Twitter/X automation remain meaningful operational risks. No prompt injection text was found in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 540 Lines analyzed
22 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01 Evidence chain Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
02 Capabilities observed Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
May execute code included with the Skill.
Not recorded by this audit
May connect to external services.
Observed in 14 evidence locations
May read or write local files.
Observed in 1 evidence location
May read values from the process environment.
Observed in 3 evidence locations
External commands May invoke commands or programs outside the Skill.
Observed in 13 evidence locations
Medium Ruby/shell backtick execution
```bash
The bash block includes installer and login commands. The Ruby-backtick label is imprecise, but external command execution is real.
Medium Ruby/shell backtick execution
```bash
The bash block lists infsh app run commands that submit prompts and actions to hosted apps. This is intended but real external execution.
Medium Ruby/shell backtick execution
| List all apps | `infsh app list` |
The inline command invokes infsh to list remote apps. Arguments are fixed, so injection risk is low, but external CLI activity is real.
Medium Ruby/shell backtick execution
| Search apps | `infsh app list --search "flux"` |
The inline command runs an infsh search against the app catalog. It is legitimate, but it still executes an external networked CLI.
Medium Ruby/shell backtick execution
| Filter by category | `infsh app list --category image` |
The inline command filters remote app listings through infsh. It has fixed arguments but remains external command execution.
Medium Ruby/shell backtick execution
| Get app details | `infsh app get google/veo-3-1-fast` |
The command retrieves hosted app details through the infsh CLI. This is expected behavior, but it contacts a remote service.
Medium Ruby/shell backtick execution
| Generate sample input | `infsh app sample google/veo-3-1-fast --save input.json` |
The command generates a sample input file through infsh and writes it locally. This is intentional but includes command execution and file output.
Medium Ruby/shell backtick execution
| Run app | `infsh app run google/veo-3-1-fast --input input.json` |
The command runs a hosted AI app with a local input file. It can transmit user data to a cloud service.
Medium Ruby/shell backtick execution
| Run without waiting | `infsh app run <app> --input input.json --no-wait` |
The no-wait command submits remote work and returns before completion. This can create background cloud tasks with user-provided input.
Medium Ruby/shell backtick execution
| Check task status | `infsh task get <task-id>` |
The command retrieves remote task status and results through infsh. It is legitimate but still performs external CLI operations.
Medium Ruby/shell backtick execution
```bash
The related-skills block uses npx to add additional skills from a remote source. This creates a supply-chain and environment-modification risk.
Low Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The documentation fetches an installer from https://cli.inference.sh. The URL is part of a remote install flow that requires trusting that host.
Low Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The reinstall command fetches the installer from a hardcoded external host. This is expected, but it is still a network trust boundary.
Low Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The CLI reference fetches an installer from a fixed external URL. The host appears intentional, but users must trust it before installation.
Low Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The README embeds a remote image hosted on cloud.inference.sh. Rendering it can trigger an external request, though no malicious domain is evident.
Low Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The installation command fetches a script from a fixed external URL. The trust boundary is real because the response is later executed.
03 Risk findings Confirmed security concerns are separated from items that still need review.
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote HTTPS response directly to sh. This executes unaudited installer code and creates a supply-chain risk.
RISK-002 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall path repeats the curl-to-shell pattern. Re-running a remote script without verification can execute compromised code.
RISK-003 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command pipes downloaded code directly into sh. This is a high-risk installer pattern unless verified out of band.
RISK-004 Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The skill instructs users to pipe a downloaded installer directly to sh. This can execute compromised remote code before review.
RISK-005 High
Social Media Automation Capability
The skill advertises Twitter/X posting and engagement actions. Authorized use could create public posts, direct messages, follows, likes, or reposts.
The referenced lines explicitly list x/post-tweet and other Twitter/X actions. This is clear business-logic risk, not a pattern-only match.
RISK-006 Medium
Remote Processing of User Inputs
The skill sends prompts and input files to hosted AI apps, and file outputs return as cloud URLs. Sensitive data may reach inference.sh and providers.
The examples show remote app runs for images, video, LLMs, search, Twitter, and 3D. The running-apps reference states outputs are returned as URLs.
04 Remediation Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001 Critical Remote shell installer commands use curl piped directly to sh.
Replace curl-to-shell instructions with signed packages, checksum verification, and explicit user confirmation before installation.
FIX-002 High Twitter/X app commands can create public or private account actions.
Require explicit review of account, action type, and final text before posting, messaging, following, liking, or reposting.
FIX-003 Medium CLI commands can transmit prompts, files, and task results to hosted services.
Add clear data-sharing warnings and require confirmation before sending sensitive prompts or files to remote apps.
FIX-004 Medium Related-skills examples install additional skills through npx.
Pin trusted sources and ask for confirmation before installing related skills or modifying the agent environment.
FIX-005 Low Shell completion examples write into user shell configuration paths.
Label shell completion setup as optional and user-initiated, and avoid running hidden config writes automatically.
05 Expert evidence Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit Unavailable
Content hash Unavailable
Tree hash Unavailable
Skill path Unavailable
Audit payload hash Unavailable Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
05
Verify and export The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable