This report does not block or authorize the manifest or ZIP.
Several external-command alerts are Markdown syntax false positives, but multiple examples intentionally run infsh commands that can post, engage, send DMs, delete posts, or install related skills. Most hardcoded URL alerts are documentation references; the remote image is a low-risk external fetch. No prompt injection or secret exfiltration evidence was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 156 Lines analyzed
16 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The fenced shell example runs infsh login and x/post-tweet, which invokes an external CLI and can publish through a connected X account. This is intended functionality, but it is a real account-impacting command path.
The shell example runs infsh to publish a tweet, which can create public content on the user account. It is a real external command with network side effects.
The block runs infsh sample and x/post-create with a media URL, causing external CLI execution and network posting. Inputs should be reviewed before execution.
The shell example runs infsh to retweet a post, which can publicly amplify content from the connected account. This is a real external command with account side effects.
The shell example runs infsh to send a direct message, which can expose private content to a recipient. This is a real external command with privacy and abuse risk.
The shell example runs infsh to follow a user, which changes the connected account relationship graph. This is a real external command with account side effects.
The shell example runs infsh to retrieve a user profile, sending a lookup request through the external CLI. It is mostly read-only but still contacts external services.
The shell example runs infsh to retrieve post details, sending a lookup request through the external CLI. It is mostly read-only but still contacts external services.
The workflow runs external AI generation and then x/post-create, combining multiple networked CLI actions with public posting. This is intended but account-impacting.
The workflow runs external video generation and then x/post-create, combining multiple networked CLI actions with public posting. This is intended but account-impacting.
The related-skills block uses npx skills add commands to install additional skills from an external source. That creates a supply-chain risk if run without review.
The line documents infsh app list as an external command, likely read-only but still executed through the external CLI. The risk is limited, but the command path is real.
The markdown embeds a remote image from cloud.inference.sh, which may trigger a third-party fetch when rendered. No secret exfiltration is evident, so the impact is low.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The skill documents apps that post tweets, like, retweet, send direct messages, follow users, delete posts, and retrieve profiles. These actions can change a connected X account or expose relationship data, so the agent should require clear approval before each command.
The listed apps and examples explicitly include posting, engagement, direct messaging, following, and deletion actions. This is intended functionality, but it is account-impacting and abuse-prone without explicit approval.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
Medium
Account-changing X commands
Require explicit confirmation before posting, liking, retweeting, sending DMs, following users, or deleting posts. Show exact text, recipients, usernames, and IDs first.
FIX-002
Medium
External CLI and service dependency
Disclose that infsh commands contact inference.sh, X, and media-generation apps. Recommend authenticating only in trusted environments.
FIX-003
Medium
Optional related-skill installation commands
Separate npx installation commands from the core workflow and instruct users to inspect the source before installing extra skills.
FIX-004
Low
Remote image in documentation
Use trusted marketplace-hosted media or omit the external image to avoid automatic third-party fetches when documentation is rendered.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.