The Agent Skills Directory

Remote Code Execution (CRITICAL): The skill instructs the user or agent to run curl -fsSL https://cli.inference.sh | sh. This is a classic 'curl pipe sh' attack vector where a script is downloaded and immediately executed. Because inference.sh is not a verified trusted source, this allows for arbitrary code execution with the permissions of the user running the command.
External Downloads (HIGH): The skill relies on fetching tools and other skills from inference.sh and inference-sh/skills via npx. These sources are not on the list of trusted GitHub organizations or repositories, posing a supply-chain risk where the downloaded content could be replaced with malicious versions.
Indirect Prompt Injection (LOW): The skill functions by taking user-provided text and inserting it into shell commands (e.g., infsh app run ... --input '{ "prompt": "..." }'). This creates a vulnerability where untrusted input can manipulate the behavior of the AI model or the CLI tool.
Ingestion points: Untrusted data enters the context through the various --input and prompt fields in the SKILL.md examples.
Boundary markers: No boundary markers or 'ignore' instructions are used to separate the user-provided prompt from the surrounding system or role instructions.
Capability inventory: The skill utilizes Bash(infsh *) which allows command-line interaction with the platform's models.
Sanitization: There is no evidence of sanitization or escaping for the input strings before they are interpolated into the JSON structures used in the shell commands.

prompt-engineering