app-store-screenshots
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a link to external installation documentation for the
infshcommand-line tool, hosted on GitHub (inference-sh/skills).\n- [COMMAND_EXECUTION]: The skill documentation includes commands for executing theinfshutility to perform AI content generation and for adding supplementary skills via thenpxpackage runner.\n- [PROMPT_INJECTION]: The skill utilizes user-provided descriptions for media generation, which represents an indirect prompt injection surface.\n - Ingestion points: User input is interpolated into the
promptfield of theinfsh app runJSON payload.\n - Boundary markers: Inputs are delimited by the JSON keys within the shell command arguments.\n
- Capability inventory: The skill is authorized to execute shell commands using the
infshtool for image and video generation.\n - Sanitization: No explicit validation or sanitization of the user-supplied prompt strings is demonstrated in the provided examples.
Audit Metadata