explainer-video-guide
Fail
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION] (CRITICAL): The file
SKILL.mdcontains the commandcurl -fsSL https://cli.inference.sh | sh. This is a piped remote script execution pattern targeting an untrusted source, which is a major security vulnerability.- [COMMAND_EXECUTION] (HIGH): The skill's configuration inSKILL.mdrequestsallowed-tools: Bash(infsh *), providing broad shell execution capabilities for theinfshutility without restricted parameters.- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill suggests installing unverified third-party skills vianpx skills addand running remote apps through theinfshtool, creating a dependency on external, unvetted infrastructure.- [PROMPT_INJECTION] (LOW): The skill is susceptible to Indirect Prompt Injection. Evidence chain: (1) Ingestion points: User-provided prompts for video and voiceover generation inSKILL.md. (2) Boundary markers: Absent. (3) Capability inventory:Bashtool for media processing and file manipulation. (4) Sanitization: None identified.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata