building-inferencesh-apps
Fail
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute installation scripts directly from the web using shell pipes. This is used to install the
beltCLI fromhttps://cli.inference.sh, theuvpackage manager fromhttps://astral.sh, thefnmNode.js manager fromhttps://fnm.vercel.app, and thenvmmanager fromhttps://raw.githubusercontent.com. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to provide templates for AI applications that ingest and process external data (e.g.,
AppInput.promptininference.pyandRunInput.promptininference.js). - Ingestion points: External data enters through the
runmethod inSKILL.md,references/python-app-logic.md, andreferences/node-app-logic.md. - Boundary markers: The provided templates do not include explicit boundary markers or instructions for the agent to ignore embedded commands within the input data.
- Capability inventory: The templates include capabilities for file system writing (
/tmp/output.png), network requests viahttpx, and model execution. - Sanitization: The instructional templates do not demonstrate sanitization or validation of the input content before processing.
- [COMMAND_EXECUTION]: The development workflow relies on the execution of the
beltCLI tool for scaffolding projects (belt app init), testing (belt app test), and deploying to the cloud (belt app deploy). - [DYNAMIC_EXECUTION]: The Python debugging and optimization guidelines in
references/python-patterns.mdrecommend programmatically modifying the Python module search path usingsys.path.appendto resolve local dependencies at runtime.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata