The Agent Skills Directory

Remote Code Execution (HIGH): The skill instructs the user or agent to execute curl -fsSL https://cli.inference.sh | sh. This pattern is highly dangerous as it downloads and executes a script with current user privileges from an external server. The source domain inference.sh is not among the verified trusted organizations.
External Downloads (MEDIUM): The skill uses npx skills add to download additional skills from the inference-sh organization. While npx is a standard tool, the source is unverifiable and untrusted, potentially leading to the execution of malicious logic.
Command Execution (MEDIUM): The skill performs multiple shell executions using the infsh binary to interact with external APIs (Twitter, browser, search). This grants the skill broad capabilities to interact with the system and network based on instruction-driven inputs.
Indirect Prompt Injection (LOW): The skill processes untrusted input for tweet generation and web searching without proper sanitization or boundary markers.
Ingestion points: SKILL.md contains multiple instances where user-provided text is passed into infsh app run commands (e.g., x/post-create, tavily/search-assistant).
Boundary markers: Absent. The inputs are directly interpolated into JSON strings within shell commands.
Capability inventory: The skill can execute subprocesses to post content to social media, take screenshots via a headless browser, and perform web searches.
Sanitization: Absent. There is no evidence of escaping or validation of the input strings before they are passed to the CLI tools.

twitter-thread-creation