twitter-thread-creation
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). The instruction to run "curl -fsSL https://cli.inference.sh | sh" pulls and executes a remote script from an unverified domain (inference.sh/cli.inference.sh), which is a high-risk pattern for delivering arbitrary/malicious code—example.com/pricing is benign placeholder content but does not mitigate the danger of the CLI install pattern.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill explicitly calls web-fetch/search apps (e.g., "infsh app run infsh/agent-browser --input '{ "url": "https://example.com/pricing\", ... }'" and the tavily/search-assistant example) to retrieve and use public web/search content as evidence for threads, which means it ingests untrusted third-party content that could carry indirect prompt injection.
Audit Metadata