The skill encourages `npx skills add`, enabling arbitrary code execution from npm, posing a significant supply chain risk.
Claims to do
Background Removal: Remove backgrounds from images via [inference.sh](https://inference.sh) CLI.
Actually does
This skill executes `infsh` CLI commands to interact with the `inference.sh` platform. It runs `infsh/birefnet` and `falai/reve` to remove or change image backgrounds, and `falai/flux-dev-lora` to generate images, taking image URLs as input. It also uses `npx skills` to add other skills and `infsh app list` to browse applications.
The skill demonstrates and encourages the use of 'npx skills add', which can download and execute arbitrary code from the npm registry. This introduces a significant supply chain risk, allowing for arbitrary command execution if a malicious package is installed.
npx skills add inference-sh/skills@infsh-cli
[](https://mondoo.com/ai-agent-security/skills/github/tool-belt/skills/background-removal)<a href="https://mondoo.com/ai-agent-security/skills/github/tool-belt/skills/background-removal"><img src="https://mondoo.com/ai-agent-security/api/badge/github/tool-belt/skills/background-removal.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/tool-belt/skills/background-removal.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.