infsh-cli
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
beltCLI binary from the vendor's distribution server (dist.inference.sh). The documentation notes that the installer verifies the binary's SHA-256 checksum and Sigstore signature if tools are available. - [REMOTE_CODE_EXECUTION]: The installation instructions include a pattern of piping a remote script to a shell (
curl -fsSL https://cli.inference.sh | sh). This is a common installation pattern for developer tools from trusted sources and is consistent with the skill's purpose of managing the inference.sh CLI. - [COMMAND_EXECUTION]: The skill utilizes shell commands via the
Bashtool to interact with the installed CLI (belt app run,belt login, etc.) and handle local file uploads for processing. - [DATA_EXPOSURE]: The skill manages local file paths (
/path/to/photo.jpg,~/.local/bin/inferencesh) and environment variables (INFSH_API_KEY). These are used legitimately within the context of the CLI's file upload and authentication functionality.
Audit Metadata