The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the user to install the belt-sh/cli tool and references external installation scripts hosted at https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. While GitHub is a common host, the specific source organization is not verified in the internal trust lists.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to execute the belt CLI. The skill's configuration appropriately uses allowed-tools to restrict the agent to only running belt commands, which follows the principle of least privilege.
[INDIRECT_PROMPT_INJECTION]: The skill features a capability to ingest untrusted data (user prompts and image URLs) which are passed to the belt CLI. There are no explicit boundary markers or sanitization steps documented to prevent the agent from potentially following instructions embedded within those prompts.
Ingestion points: The --input JSON object, specifically the prompt and image_url fields in SKILL.md examples.
Boundary markers: Absent from the provided instructions.
Capability inventory: Execution of the belt CLI tool via the Bash tool.
Sanitization: No evidence of input escaping or validation within the skill instructions.

ai-image-generation