ai-video-generation
Fail
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command in the Quick Start section (
curl -fsSL https://cli.inference.sh | sh) that fetches a remote script and executes it directly via the shell. This pattern allows for the execution of unverified code from a third-party domain.\n- [COMMAND_EXECUTION]: The skill instructs the agent to use theinfshtool via the Bash tool to process video generation requests. It interpolates user-supplied prompts and URLs directly into shell command arguments without providing sanitization or escaping mechanisms.\n - Ingestion points: User prompts and URLs provided to the
infsh app runcommands (SKILL.md).\n - Boundary markers: Absent; user input is placed inside JSON strings within shell command arguments.\n
- Capability inventory: Access to the
infshbinary via theBashtool.\n - Sanitization: No instructions are provided for validating or escaping special characters in user-controlled inputs, which could be exploited for command injection.\n- [EXTERNAL_DOWNLOADS]: The installation process involves downloading binaries from
dist.inference.sh.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata