This report does not block or authorize the manifest or ZIP.
Most static external-command findings are Markdown backticks or app identifiers, not Ruby execution. The skill still contains real infsh and npx command examples that can post, delete, message, follow, install related skills, and contact inference.sh services.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 156 Lines analyzed
17 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Line 15 documents an npx install command that can fetch and install a skill from an external source. This is a real external command risk even though it appears inside Markdown backticks.
The Quick Start code block includes infsh login and an infsh app run command that posts to Twitter/X. These commands perform network and account actions through an external CLI.
This code block runs infsh to query a user profile through the external service. It is read-only, but it is still an external command and network action.
The workflow runs external infsh apps to generate an image and publish it to Twitter/X. It combines network calls, local file output, and account posting.
The workflow runs external infsh apps to generate a video and publish it to Twitter/X. It combines network calls, local file output, and account posting.
The range includes an infsh app list command, which invokes the external CLI and contacts the app ecosystem. The action is read-only, so confidence and impact are lower.
The Markdown image points to a remote cloud.inference.sh asset. Rendering the marketplace page could trigger a third-party request and expose viewer metadata.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The skill advertises engagement bots and audience growth, and it documents likes, retweets, direct messages, and follows. These workflows can enable spam, unsolicited messaging, or platform manipulation without strict approval.
The description and examples explicitly mention engagement bots, audience growth, DMs, likes, retweets, and follows. This is an intent-level abuse risk that static pattern matching does not capture.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
High
Automated engagement workflows can be abused for spam or platform manipulation.
Add guardrails against bulk follows, unsolicited DMs, artificial engagement, and other prohibited automation.
FIX-002
Medium
External account actions can change a Twitter/X account.
Require explicit user confirmation before posting, deleting, messaging, liking, retweeting, or following.
FIX-003
Medium
The documentation includes npx skill installation commands.
Move installation to prerequisites, pin trusted sources, and avoid running install commands automatically.
FIX-004
Low
A remote Markdown image can trigger a third-party fetch when rendered.
Use a local marketplace asset or remove the remote image from published documentation.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.