Skills
▥
skills/1nfsh-s3/skills/google-veo/Gen Agent Trust Hub

google-veo

Fail

Audited by Gen Agent Trust Hub on Feb 19, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION] (HIGH): The skill documentation explicitly instructs the user or agent to execute curl -fsSL https://cli.inference.sh | sh. This is a classic remote code execution pattern that runs unverified scripts from a third-party domain directly in the shell environment. Although this is the primary installation method for the required infsh tool, the source is not among the defined trusted organizations.- [EXTERNAL_DOWNLOADS] (MEDIUM): The installation process involves downloading binaries from dist.inference.sh. While the skill claims these are verified via SHA-256, the initial script performing the verification is itself retrieved over the network without prior local validation.- [COMMAND_EXECUTION] (MEDIUM): The skill defines and uses the infsh tool via the Bash tool. The security of these commands is entirely dependent on the integrity of the binary installed via the insecure method mentioned above.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 19, 2026, 09:03 PM