The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to install the belt CLI by running curl -fsSL https://cli.inference.sh | sh. This pattern executes a remote shell script directly on the host system without verification, which is a significant security risk.
[EXTERNAL_DOWNLOADS]: During manual installation, the skill fetches binary files and checksums from dist.inference.sh.
[PRIVILEGE_ESCALATION]: The CLI reference suggests writing shell completions to /etc/bash_completion.d/. This operation typically requires root or administrative privileges and involves modifying system-wide configuration directories.
[DATA_EXFILTRATION]: The belt CLI is designed to automatically upload local files to the inference.sh cloud service when a file path is provided in the input JSON (e.g., belt app run ... --input '{"image": "/path/to/photo.jpg"}'). This behavior presents a high risk of sensitive data exfiltration if an attacker or a malicious prompt tricks the agent into targeting system files like ~/.ssh/id_rsa or .env files.
[INDIRECT_PROMPT_INJECTION]: The skill frequently interacts with external AI apps and web search providers, making it vulnerable to indirect prompt injection.
Ingestion points: The agent processes untrusted output from third-party models (Claude, Grok, Gemini) and search tools (Tavily, Exa) via the belt app run command.
Boundary markers: No delimiters or safety instructions are provided to help the agent distinguish between app data and its own system instructions.
Capability inventory: The agent has the ability to execute shell commands and upload files to the internet.
Sanitization: The skill lacks any mechanism to sanitize or validate the content returned from external AI services before it is integrated into the agent's context.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to interact with the belt CLI, granting the agent a wide range of capabilities on the local machine including app deployment, searching, and file management.

agent-tools