text-to-speech
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to install the
infshCLI tool using the commandcurl -fsSL https://cli.inference.sh | sh. This pattern involves downloading a script from the vendor's domain and executing it directly in the shell. While this is a remote code execution pattern, it is the official installation method provided by the service vendor (inference.sh) for their own tool. - [EXTERNAL_DOWNLOADS]: The skill references external resources for installation and model execution, specifically fetching the CLI script from
cli.inference.shand binaries fromdist.inference.sh. These downloads originate from the vendor's official infrastructure. - [COMMAND_EXECUTION]: The skill relies on executing the
infshcommand-line tool with various subcommands (login,app run,app list,app sample) to perform its primary functions. These commands are executed within the user's shell environment to interact with the inference.sh platform. - [DATA_EXFILTRATION]: The CLI tool sends user-provided text or JSON configuration files to the inference.sh API servers to generate speech. This is the intended functional behavior of the skill, and the data is sent to the vendor's established service domains.
Audit Metadata