belt
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The manual installation instructions involve downloading a shell script from
https://cli.inference.shto a temporary directory and executing it usingsh. The instructions include a specific step for the user to review the script content viacatbefore running it. This script is hosted on the vendor's distribution domain. - [EXTERNAL_DOWNLOADS]: The skill facilitates software installation through multiple external registries and vendor-controlled repositories. This includes the official Homebrew tap
inference-sh/tap/belt, a Scoop bucket hosted atgithub.com/belt-sh/scoop-belt, and the scoped NPM package@inferencesh/belt. - [COMMAND_EXECUTION]: The skill grants the agent authority to execute various CLI subcommands under the
beltbinary. These commands cover authentication (belt login), account management (belt me), plugin initialization, and execution of AI applications or MCP connectors. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data which serves as a potential surface for indirect injection.
- Ingestion points: JSON data provided via the
--inputflag inbelt app runand results retrieved frombelt knowledge searchor external MCP connectors. - Boundary markers: None are explicitly defined in the instructional text.
- Capability inventory: The skill can execute local commands via the
Bashtool (restricted to thebeltCLI and package managers) and interact with remote services through the CLI's network capabilities. - Sanitization: The skill documentation emphasizes the use of typed inputs and schema validation within the CLI to minimize errors and manage data safely.
Audit Metadata