ai-video-generation

Fail

Audited by Socket on Feb 24, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

[Skill Scanner] Pipe-to-shell or eval pattern detected This skill's stated purpose (AI video generation via inference.sh hosted apps) is consistent with the capabilities and examples. However, the install and execution pattern (curl https://cli.inference.sh | sh) is a high-risk supply-chain signal and the central CLI forwards credentials and user data to remote services. No explicit malicious code is present in the documentation itself, but the combination of pipe-to-shell installation and credential/data forwarding through a third-party CLI raises significant security risk. Treat this integration as suspicious: acceptable for non-sensitive workloads if you trust inference.sh and verify the installer, but do not run the unverified install on sensitive systems or with long-lived high-privilege credentials. LLM verification: This SKILL.md is a documentation file that accurately describes an inference.sh-based AI video-generation skill and its model capabilities. The file itself contains no embedded malicious code or hardcoded secrets, but it instructs users to install the CLI by piping a remote script into the shell (curl https://cli.inference.sh | sh) and to authenticate against the inference.sh platform. Those patterns create a significant supply-chain and credential-forwarding risk: executing an unverified remote

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 24, 2026, 07:52 AM
Package URL
pkg:socket/skills-sh/NeverSight%2Fskills_feed%2Fai-video-generation%2F@f0f1dfc9027423ad3230ac826f1388fc3aad69b1