social-media-carousel
Fail
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- REMOTE_CODE_EXECUTION (CRITICAL): The skill uses
curl -fsSL https://cli.inference.sh | shto install its CLI tool. Piped execution from untrusted sources is a critical vulnerability that allows an external party to execute arbitrary commands on the host system without inspection.\n- EXTERNAL_DOWNLOADS (HIGH): The skill pulls tools and additional skill modules from theinference.shdomain and vianpx skills add, which are not authorized trusted sources, bypassing supply chain security controls.\n- COMMAND_EXECUTION (MEDIUM): The skill makes extensive use of the Bash tool to run the installed CLI, manage logins, and execute batch processing loops, granting the unverified software access to the local execution environment.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata