agent-tools
Fail
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill repeatedly instructs users to install its CLI tool by piping a remote script directly to the shell:
curl -fsSL https://cli.inference.sh | sh. This is a classic RCE pattern where the contents of the remote URL are executed without prior verification. - [EXTERNAL_DOWNLOADS]: The skill downloads binaries and configuration manifests from external domains including
cli.inference.shanddist.inference.shduring both the 'easy' and 'manual' installation processes. - [PERSISTENCE]: The documentation provides commands to install shell completions that modify system-wide and user-specific shell configurations, such as writing to
/etc/bash_completion.d/infshand~/.config/fish/completions/infsh.fish. - [PRIVILEGE_ESCALATION]: Writing shell completions to the
/etc/directory (e.g.,/etc/bash_completion.d/infsh) typically requires administrative privileges, which the skill encourages. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a wide variety of untrusted external sources, including LLMs (Grok, Claude, Gemini), web search results (Tavily, Exa), and Twitter automation, which serves as a significant surface for indirect prompt injection attacks.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata