The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user (or agent) to install the belt CLI using a piped shell script method: curl -fsSL https://cli.inference.sh | sh. This is a common but sensitive operation for downloading and executing remote code.
Evidence: Found in SKILL.md, references/authentication.md, and references/cli-reference.md.
Mitigation: The skill proactively provides a 'Manual install' section in SKILL.md that includes SHA-256 checksum verification and Sigstore signature verification via cosign, which are recommended best practices for verifying the integrity of downloaded binaries.
[COMMAND_EXECUTION]: The skill uses the Bash(belt *) tool to interact with the installed CLI. It executes commands such as belt app run, belt login, and belt task get to perform its functions.
Evidence: The allowed-tools field in SKILL.md frontmatter and various examples throughout the documentation.
[EXTERNAL_DOWNLOADS]: The CLI tool itself facilitates the upload of local files (images, audio, etc.) to the inference.sh platform when running AI models.
Evidence: Described in SKILL.md and references/running-apps.md under the 'Local File Uploads' sections. This is a primary intended function of the tool for processing local media with cloud-based AI models.

infsh-cli