twitter-thread-creation
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes an installation command
curl -fsSL https://cli.inference.sh | shthat pipes a remote script to the shell. This is a standard installation pattern for the vendor's CLI tool and originates from the author's primary domain (inference.sh). - [EXTERNAL_DOWNLOADS]: The skill references binary downloads from
dist.inference.shand usesnpxto install additional skill packages from theinference-shGitHub repository. It also utilizes well-known services like Tavily for search assistance. - [COMMAND_EXECUTION]: The skill utilizes the
infshcommand-line tool to perform tasks like posting content and generating images. The skill's metadata restricts command execution to theinfshtoolset using theallowed-toolsfield, which limits the potential attack surface.
Audit Metadata