ai-rag-pipeline
Fail
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command that pipes a remote script directly to a shell (
curl -fsSL https://cli.inference.sh | sh). This script is hosted on the vendor's own domain. - [EXTERNAL_DOWNLOADS]: The skill downloads installation scripts and binaries from
cli.inference.shanddist.inference.shas part of its setup instructions. - [COMMAND_EXECUTION]: The skill utilizes the
infshCLI tool via Bash to perform search, extraction, and LLM processing. The execution is restricted to theinfshcommand prefix in the skill configuration. - [PROMPT_INJECTION]: The skill documentation exhibits an indirect prompt injection surface:
- Ingestion points: External content from web searches and URL extraction (Tavily/Exa) is stored in shell variables (e.g.,
$SEARCH_RESULT,$CONTENT) inSKILL.md. - Boundary markers: Absent; external content is directly interpolated into prompt strings without delimiters or instructions to ignore embedded commands.
- Capability inventory: The
infshtool can interact with various LLMs (Claude, GPT-4, Gemini) and search engines through the Bash tool inSKILL.md. - Sanitization: Absent; there is no logic provided to escape or validate the retrieved web content before it is passed to the LLM apps.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata