The Agent Skills Directory

Unverifiable Dependencies & Remote Code Execution (CRITICAL): The skill explicitly instructs the agent or user to execute curl -fsSL https://cli.inference.sh | sh. This is a classic piped-to-shell attack vector where a script from an untrusted external domain is executed with local privileges.
Evidence: SKILL.md contains the command sequence curl -fsSL https://cli.inference.sh | sh && infsh login.
Source: https://cli.inference.sh is not a trusted source per the analysis guidelines.
Indirect Prompt Injection (LOW): The skill is designed to ingest untrusted data from the web via tavily/extract and exa/extract apps. This creates a surface for attackers to embed instructions in web pages that the agent may mistakenly follow.
Ingestion points: infsh app run tavily/extract and infsh app run exa/extract in SKILL.md.
Boundary markers: Absent; extracted content is passed directly to LLM prompts in example workflows.
Capability inventory: The skill has permission to execute shell commands via allowed-tools: Bash(infsh *).
Sanitization: No sanitization logic is present to filter malicious instructions from extracted web content.

web-search