The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The skill contains the command curl -fsSL https://cli.inference.sh | sh. This pattern downloads an opaque script from a non-whitelisted domain and executes it immediately in the shell. This is a classic delivery mechanism for malicious payloads and lacks any integrity verification.
[EXTERNAL_DOWNLOADS] (HIGH): The skill recommends installing several external packages via npx skills add inference-sh/skills@.... Since inference-sh is not a trusted organization (like Anthropic, Google, or Microsoft), this introduces a high risk of supply chain attack through unverified code.
[COMMAND_EXECUTION] (MEDIUM): The allowed-tools configuration provides the agent with the ability to execute any command starting with infsh. If the infsh CLI tool has vulnerabilities or features that allow file system or network access, this broad permission scope could be exploited.
[INDIRECT_PROMPT_INJECTION] (LOW): The skill processes user-provided inputs (prompts and image paths) and interpolates them into shell commands (infsh app run).
Ingestion points: prompt and image fields in JSON payloads.
Boundary markers: None (direct interpolation inside single/double quotes).
Capability inventory: Bash(infsh *) tool allows for shell-based command execution.
Sanitization: None observed in the provided skill definition. This creates a surface where malicious input could attempt to break out of the JSON structure or command arguments.

image-to-video