The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation includes an installation command that pipes a remote script directly into the shell (curl -fsSL https://cli.inference.sh | sh). This pattern bypasses local validation and can lead to arbitrary code execution if the remote source is compromised.
[EXTERNAL_DOWNLOADS]: The skill references and downloads binaries from dist.inference.sh and scripts from cli.inference.sh. While these are vendor resources associated with the author, they represent an external dependency chain that is executed on the host system.
[COMMAND_EXECUTION]: The skill is configured with broad tool permissions (Bash(infsh *)), allowing the agent to execute any subcommand of the infsh CLI. This increases the potential impact of any command injection or malicious prompt processing.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8).
Ingestion points: The skill accepts untrusted data through the prompt and images parameters in the JSON input to the CLI.
Boundary markers: There are no boundary markers or explicit instructions provided to the agent to treat the prompt or images content as data rather than instructions.
Capability inventory: The skill possesses the ability to execute shell commands and interact with the infsh platform, providing a significant range of actions for an attacker to influence.
Sanitization: No input sanitization or validation logic is defined to protect against malicious payloads embedded in the user-provided prompts or image URLs.

nano-banana