ai-marketing-videos

Fail

Audited by Socket on Feb 25, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

The skill description aligns with its purpose of generating AI-driven marketing videos via an external CLI with a multi-step workflow. However, the bootstrap method (curl -fsSL https://cli.inference.sh | sh) and reliance on remote binaries and assets introduce supply-chain and execution risks. The presence of checksum verification is positive, but without strong, reproducible, multi-source verification and pinned binaries, this pattern remains a notable risk. Recommend safer bootstrap strategies (e.g., signed packages, reproducible builds, and multi-source pinning) and explicit asset provenance to mitigate risks.

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 25, 2026, 05:38 PM
Package URL
pkg:socket/skills-sh/inference-sh-9%2Fskills%2Fai-marketing-videos%2F@f4d06a62f44ef086de46ac6a3b18cdd01dfd817a