skills/belt-sh/cli/belt/Gen Agent Trust Hub

belt

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The manual installation instructions involve downloading a shell script from https://cli.inference.sh to a temporary directory and executing it using sh. The instructions include a specific step for the user to review the script content via cat before running it. This script is hosted on the vendor's distribution domain.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates software installation through multiple external registries and vendor-controlled repositories. This includes the official Homebrew tap inference-sh/tap/belt, a Scoop bucket hosted at github.com/belt-sh/scoop-belt, and the scoped NPM package @inferencesh/belt.
  • [COMMAND_EXECUTION]: The skill grants the agent authority to execute various CLI subcommands under the belt binary. These commands cover authentication (belt login), account management (belt me), plugin initialization, and execution of AI applications or MCP connectors.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data which serves as a potential surface for indirect injection.
  • Ingestion points: JSON data provided via the --input flag in belt app run and results retrieved from belt knowledge search or external MCP connectors.
  • Boundary markers: None are explicitly defined in the instructional text.
  • Capability inventory: The skill can execute local commands via the Bash tool (restricted to the belt CLI and package managers) and interact with remote services through the CLI's network capabilities.
  • Sanitization: The skill documentation emphasizes the use of typed inputs and schema validation within the CLI to minimize errors and manage data safely.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 05:08 AM