technical-blog-writing
Fail
Audited by Gen Agent Trust Hub on Feb 18, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION] (CRITICAL): The skill uses a piped shell command to download and execute a script from
https://cli.inference.sh. This is a critical security risk because it bypasses all code review and integrity checks, allowing the remote server to execute any command on the agent's host system. - [EXTERNAL_DOWNLOADS] (HIGH): The skill attempts to fetch and execute content from a non-whitelisted domain (
cli.inference.sh). Since this domain is not a recognized trusted source, the integrity and intent of the code cannot be verified. - [COMMAND_EXECUTION] (HIGH): The direct piping of remote content into a shell (
| sh) is an unsafe practice that provides no opportunity for the agent or the user to sanitize or inspect the instructions before they are processed by the operating system.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata