The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The skill documentation explicitly instructs users to run curl -fsSL https://cli.inference.sh | sh in the Quick Start section of SKILL.md. This pattern is a critical vulnerability as it executes code directly from a remote, untrusted server without any verification or integrity checks.
[EXTERNAL_DOWNLOADS] (MEDIUM): The skill utilizes npx to fetch additional skills from the inference-sh organization in SKILL.md. Since this organization is not on the trusted list, these downloads are considered unverifiable and risky.
[COMMAND_EXECUTION] (MEDIUM): The skill requests permission to use the Bash tool with infsh * in SKILL.md. This allows for broad execution of commands through a CLI tool that was installed via an insecure method, significantly increasing the attack surface.
[PROMPT_INJECTION] (LOW): The skill exhibits an indirect prompt injection surface as it processes untrusted user data via LLM prompts without documented boundary markers or sanitization. Evidence: (1) Ingestion at SKILL.md via model prompt examples; (2) Boundary markers are absent; (3) Capability for Bash execution exists via the infsh tool; (4) No sanitization or escaping steps are documented.

llm-models