The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill repeatedly instructs the user or agent to execute a remote script via curl -fsSL https://cli.inference.sh | sh in SKILL.md, references/authentication.md, and references/cli-reference.md. This pattern downloads and executes code from a non-whitelisted remote domain directly in the shell without prior user review.\n- [DATA_EXFILTRATION]: The belt CLI tool, which is the primary tool used by this skill, is documented in SKILL.md and references/running-apps.md to 'automatically upload local files' whenever a local path is provided instead of a URL in input arguments. This provides a direct mechanism for an agent to be tricked into uploading sensitive local files (such as SSH keys or environment secrets) to external servers.\n- [PRIVILEGE_ESCALATION]: The CLI reference in references/cli-reference.md provides instructions to write shell completion scripts to /etc/bash_completion.d/. Modifying this directory typically requires root/administrative privileges and can be used as a persistence mechanism or to interfere with system behavior.\n- [COMMAND_EXECUTION]: The skill requests broad permissions via the Bash(belt *) tool, allowing the agent to execute any subcommand of the belt CLI. This CLI tool is capable of performing network operations, file uploads, and credential management (belt login).\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect prompt injection by processing untrusted data that controls critical system capabilities.\n
Ingestion points: The belt app run command accepts untrusted JSON payloads and file paths via the --input argument, as seen in SKILL.md.\n
Boundary markers: The instructions lack any boundary markers or safety guidelines to help the agent distinguish between data and malicious instructions embedded in the input strings.\n
Capability inventory: The skill combines shell access via the Bash tool with the ability to read arbitrary local files and upload them to a remote network endpoint.\n
Sanitization: The documentation states the tool 'automatically uploads' any provided local path, indicating a lack of input validation or path sanitization.

agent-tools