landing-page-design

[Skill Scanner] Pipe-to-shell or eval pattern detected All findings: [CRITICAL] command_injection: Pipe-to-shell or eval pattern detected (CI013) [AITech 9.1.4] [CRITICAL] command_injection: Natural language instruction to download and install from URL detected (CI009) [AITech 9.1.4] [CRITICAL] command_injection: Natural language instruction to download and install from URL detected (CI009) [AITech 9.1.4] No evidence of embedded malware or intentional malicious code inside this skill markdown itself. The primary risks are operational: (1) the documented installation uses 'curl | sh' to fetch and execute a remote installer and (2) the skill routes user-provided prompts/HTML to a third-party hosted service (inference.sh / dist.inference.sh), which may store or process sensitive inputs. If a user intends to follow the examples, they should audit the installer script and understand the CLI's authentication and data retention policies. Overall the skill appears functionally consistent with its stated purpose but carries normal supply-chain/trust risks from installing and running an external CLI and sending data to a hosted inference service.