ai-video-generation
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command
curl -fsSL https://cli.inference.sh | shwhich pipes a remote script into the shell. This is a common installation pattern for CLI tools and originates from the vendor's official domain. - [EXTERNAL_DOWNLOADS]: The skill references binary downloads from
dist.inference.shfor CLI installation and verification. These resources are hosted on the vendor's infrastructure. - [COMMAND_EXECUTION]: The skill utilizes the
infshcommand to interact with various AI models. The execution environment is appropriately restricted via theallowed-toolsfrontmatter, limiting the agent to theinfshcommand only. - [PROMPT_INJECTION]: The skill processes user-supplied prompts and media URLs as arguments to the
infshCLI. - Ingestion points: Command-line arguments in
SKILL.md(e.g.,--input). - Boundary markers: None explicitly defined in the prompt instructions.
- Capability inventory: Execution of the
infshCLI tool via Bash. - Sanitization: Not present in the skill instructions; however, this is standard behavior for a tool-based skill and does not indicate malicious intent.
Audit Metadata