llm-models
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install external components via
npx skills addand provides links to installation instructions hosted on a public GitHub repository (inference-sh/skills). This involves fetching and executing third-party code to set up the necessary environment.\n- [COMMAND_EXECUTION]: The skill requires the use of thebeltCLI tool to perform login and model execution tasks. These operations involve shell commands that interact with the local system and remote services.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided strings as prompts for language models. This creates a surface where untrusted data could contain instructions that influence the agent's behavior during interaction with the LLMs.\n - Ingestion points: Prompts and system instructions passed through the
--inputflag or via JSON files in theSKILL.mdexamples.\n - Boundary markers: None; the content is passed directly to the model without specific delimiters or warnings to ignore embedded instructions.\n
- Capability inventory: The skill can execute CLI commands (
belt) and requires network access to communicate with model endpoints.\n - Sanitization: No sanitization or validation of the prompt content is specified in the instruction examples.
Audit Metadata