technical-blog-writing

Fail

Audited by Socket on Feb 25, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

This skill document is primarily benign guidance for writing technical blog posts and using the infsh CLI and apps. The main security concern is the installer pattern: curl | sh to execute a remote installer (download-and-execute) — a well-known supply-chain risk. Additional moderate concerns: reliance on a non-standard distribution domain (dist.inference.sh), remote execution of user-provided HTML/Python via the hosted service (which requires trusting the operator with inputs/outputs), and examples that imply forwarding of credentials to enable social posting. There are no hardcoded secrets or obvious obfuscated/malicious code in the provided text. Overall, treat this as a potentially useful tool but with elevated supply-chain and data-exposure risk; users must manually verify checksums, understand where credentials are stored, and avoid sending secrets in examples or app inputs.

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 25, 2026, 05:38 PM
Package URL
pkg:socket/skills-sh/inference-sh-9%2Fskills%2Ftechnical-blog-writing%2F@115b89a0738e3a07f1719c4acb866a7e4c6658da