Skills
Navigate
skills/coco-research/coco/ai-marketing-videos/Gen Agent Trust Hub

ai-marketing-videos

Fail

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download a setup script from a remote URL and execute it locally using the shell.
  • Evidence: curl -fsSL https://cli.inference.sh -o /tmp/infsh-install.sh followed by bash /tmp/infsh-install.sh in the Quick Start section.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing supplementary third-party skill packages using the npx skills add command.
  • Evidence: References to packages such as inference-sh/skills@ai-video-generation and inference-sh/skills@inference-sh.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest user-provided prompts and interpolate them into CLI commands, which can be a surface for indirect injection if processing untrusted data.
  • Ingestion points: Prompt fields within the infsh app run commands throughout SKILL.md.
  • Boundary markers: Instructions use JSON-formatted input strings as delimiters.
  • Capability inventory: The skill utilizes the Bash tool to execute infsh commands.
  • Sanitization: No explicit sanitization or validation of the prompt content is described before interpolation into the CLI call.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Nov 7, 2026, 06:11 PM