building-inferencesh-apps
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions include commands to fetch and execute the official
inference.shcommand-line interface (CLI) directly from the platform's domain. - Evidence in
SKILL.md:curl -fsSL https://cli.inference.sh | sh - [REMOTE_CODE_EXECUTION]: The documentation provides standard installation commands for well-known developer utilities, including the
uvpackage manager,fnm(Fast Node Manager), andnvm(Node Version Manager) from their official repositories. - Evidence in
references/cli.md:curl -LsSf https://astral.sh/uv/install.sh | shandcurl -fsSL https://fnm.vercel.app/install | bash - [PRIVILEGE_ESCALATION]: The Windows installation reference for the
uvtool utilizes a command that bypasses the default PowerShell execution policy to allow script execution. - Evidence in
references/cli.md:powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" - [SAFE]: The skill provides templates that implement standard security practices for handling sensitive data, such as using environment variables for API keys and Hugging Face tokens rather than hardcoding credentials.
- Evidence in
references/python-secrets-oauth.mdandreferences/node-secrets-oauth.md.
Audit Metadata