The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation repeatedly instructs the user to install the belt CLI using a dangerous pattern that downloads a script from https://cli.inference.sh and pipes it directly into the shell (| sh). This allows for the execution of unverified remote code on the host system.
Evidence found in SKILL.md, references/authentication.md, and references/cli-reference.md.
[DATA_EXFILTRATION]: The CLI tool (belt) described in the skill has a feature where it automatically detects local file paths provided in inputs and uploads those files to the inference.sh cloud. While intended for processing media, this capability can be abused to exfiltrate sensitive files (e.g., SSH keys, configuration files, or database backups) if the agent is directed to process a sensitive path.
Evidence in SKILL.md and references/running-apps.md: The CLI automatically uploads local files when you provide a path instead of a URL.
[COMMAND_EXECUTION]: The skill configuration (allowed-tools) grants the agent permission to execute any belt command. This enables the agent to perform network operations, file uploads, and authentication tasks autonomously.
[INDIRECT_PROMPT_INJECTION]: The skill creates a vulnerability surface for indirect prompt injection by combining data ingestion with powerful file-handling capabilities.
Ingestion points: The agent processes data from external AI apps and user-provided inputs via the belt tool.
Boundary markers: There are no specific instructions or delimiters provided to ensure the agent ignores malicious instructions that might be embedded in the data processed by the apps.
Capability inventory: The belt tool can read any local file the user has access to and upload it to a remote endpoint.
Sanitization: The instructions do not specify any validation or sanitization of file paths before they are passed to the belt app run command.

infsh-cli