Skills
skills/1nfsh/skills/product-hunt-launch/Gen Agent Trust Hub

product-hunt-launch

Fail

Audited by Gen Agent Trust Hub on Feb 18, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION] (HIGH): The skill explicitly instructs users to run curl -fsSL https://cli.inference.sh | sh. This is a high-risk pattern that downloads and executes code from a non-trusted external source directly in the terminal, bypassing verification or auditing.
  • [EXTERNAL_DOWNLOADS] (MEDIUM): The skill promotes the installation of external dependencies from the inference-sh organization via npx skills add. These packages are hosted on an untrusted source and have not been vetted.
  • [COMMAND_EXECUTION] (MEDIUM): The skill utilizes the infsh CLI tool to execute various remote applications (e.g., image generation and search). Because this tool is installed through an unverified script, it grants broad and unvetted execution capabilities over the local environment.
  • [INDIRECT_PROMPT_INJECTION] (LOW): The skill ingests untrusted data from web search tools (tavily/search-assistant and exa/search) to help with research. While no specific exploit is present, there is a risk of indirect prompt injection as there are no boundary markers or sanitization logic to prevent malicious content in search results from influencing the agent's behavior.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 18, 2026, 01:48 AM
Security Audit — agent-trust-hub — product-hunt-launch