press-release-writing
Fail
Audited by Snyk on Feb 18, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). These URLs host a remote shell-installer (curl ... | sh) on a third-party .sh domain — running unverified scripts fetched from such domains is a high-risk distribution pattern that can deliver malware unless the domain/script integrity and reputation are confirmed.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to perform web research and fact‑checking via the inference.sh CLI (e.g., "infsh app run tavily/search-assistant" and "infsh app run exa/search" commands), which fetches open/public search results that are untrusted third‑party content the agent is expected to read and interpret.
Audit Metadata