The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for the CLI use a piped shell execution pattern (curl -fsSL https://cli.inference.sh | sh). This method executes a script directly from a remote source without prior inspection, which is a significant security risk if the remote server or the transport mechanism is compromised.
[COMMAND_EXECUTION]: The skill requires access to the Bash tool to execute the infsh CLI. It performs various tasks such as image generation, video creation, and Twitter automation by running shell commands.
[EXTERNAL_DOWNLOADS]: The skill downloads binaries and manifest files from external domains (dist.inference.sh). While the documentation mentions checksum and signature verification (via Sigstore/cosign), these are handled within the downloaded scripts or manual instructions.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface
Ingestion points: The skill reads user-provided JSON files via the --input flag in the infsh app run command.
Boundary markers: None identified in the provided instructions; inputs are passed directly to CLI arguments or files.
Capability inventory: The skill uses Bash(infsh *) to execute commands and interact with external AI services.
Sanitization: There is no mention of sanitization or validation of the input data before it is processed by the CLI tool.

agent-tools