ai-social-media-content
Fail
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run 'curl -fsSL https://cli.inference.sh | sh', which downloads a script from a remote server and executes it directly in the shell. This pipe-to-shell pattern is a high-risk vulnerability that allows for arbitrary, unreviewed code execution on the local system.
- [EXTERNAL_DOWNLOADS]: The skill uses 'npx skills add inference-sh/skills@...' to install additional external dependencies at runtime. This introduces supply chain risks by fetching and installing code from a remote repository.
- [COMMAND_EXECUTION]: The skill relies heavily on executing commands via the 'infsh' CLI, including authentication ('infsh login') and running various AI applications ('infsh app run'). This involves significant interaction with the local host environment and external APIs.
- [DATA_EXFILTRATION]: The skill provides automated workflows for posting content to external social media platforms (e.g., 'twitter/post-tweet'). This capability could potentially be used to exfiltrate data from the local environment to public social feeds.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata