Skills
Navigate
skills/inf-sh/skills/image-to-video/Gen Agent Trust Hub

image-to-video

Fail

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill uses a curl | sh pattern to install the CLI tool from https://cli.inference.sh. This is documented as the official installation method for the platform.
  • [COMMAND_EXECUTION]: Interaction with the platform is performed via the Bash tool, restricted to the infsh command set.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by interpolating user input into command arguments.
  • Ingestion points: User prompts provided as JSON input for the infsh app run commands.
  • Boundary markers: None present; inputs are directly placed within JSON structures without instructions to ignore embedded commands.
  • Capability inventory: The Bash tool is used to execute infsh commands.
  • Sanitization: There is no evidence of sanitization or validation performed on the user-provided prompts before execution.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 4, 2026, 09:10 PM
Security Audit — agent-trust-hub — image-to-video