The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation instructions (found in SKILL.md and references/authentication.md) utilize curl -fsSL https://cli.inference.sh | sh to download and execute a script from a remote server directly in the shell. This pattern allows for the execution of arbitrary remote code from an untrusted source.
[DATA_EXFILTRATION]: The belt CLI tool, which the skill is designed to use, automatically reads local files and uploads them to external servers (inference.sh) when a local file path is provided in the input JSON. This behavior, documented in SKILL.md and references/running-apps.md, creates a significant risk of accidental sensitive data exfiltration.
[PRIVILEGE_ESCALATION]: Documentation in references/cli-reference.md suggests writing shell completion files to system directories like /etc/bash_completion.d/, which requires root privileges and modifies system-wide configurations.
[PERSISTENCE]: The skill recommends installing shell completions into shell configuration and system directories, which serves as a persistence mechanism by ensuring the tool's code or configurations are loaded in every new shell session.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing untrusted data (prompts and local files) and passing them to various AI models via the CLI.
Ingestion points: Untrusted JSON input and local file paths passed to the belt app run command via the --input flag.
Boundary markers: None identified.
Capability inventory: Shell command execution, network communication, and local file system access (read/upload).
Sanitization: No evidence of input sanitization or validation before transmission to remote AI services.

agent-tools