landing-page-design
Fail
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute
curl -fsSL https://cli.inference.sh | sh. This pattern downloads a shell script from a remote server and pipes it directly into the shell for execution, allowing the remote server to execute arbitrary commands on the user's system. - [EXTERNAL_DOWNLOADS]: The skill relies on external binary tools and scripts hosted at
cli.inference.sh. It also suggests adding related skills vianpx skills add, which involves downloading and installing third-party packages from GitHub/npm registries. - [COMMAND_EXECUTION]: The skill frequently uses the
infshcommand-line tool to interact with remote AI models (e.g.,infsh app run falai/flux-dev-lora). While these are presented as examples for the user, the skill's environment (allowed-tools) explicitly permits theBash(infsh *)tool, enabling the agent to execute these commands autonomously.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata