building-inferencesh-apps

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The instructions include commands to fetch and execute the official inference.sh command-line interface (CLI) directly from the platform's domain.
  • Evidence in SKILL.md: curl -fsSL https://cli.inference.sh | sh
  • [REMOTE_CODE_EXECUTION]: The documentation provides standard installation commands for well-known developer utilities, including the uv package manager, fnm (Fast Node Manager), and nvm (Node Version Manager) from their official repositories.
  • Evidence in references/cli.md: curl -LsSf https://astral.sh/uv/install.sh | sh and curl -fsSL https://fnm.vercel.app/install | bash
  • [PRIVILEGE_ESCALATION]: The Windows installation reference for the uv tool utilizes a command that bypasses the default PowerShell execution policy to allow script execution.
  • Evidence in references/cli.md: powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
  • [SAFE]: The skill provides templates that implement standard security practices for handling sensitive data, such as using environment variables for API keys and Hugging Face tokens rather than hardcoding credentials.
  • Evidence in references/python-secrets-oauth.md and references/node-secrets-oauth.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 02:18 PM
Security Audit — agent-trust-hub — building-inferencesh-apps