The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation in SKILL.md instructs users to install the CLI tool using curl -fsSL https://cli.inference.sh | sh, which is a pattern that executes remote code directly in the shell. Additional remote code is fetched during the update process and manual installation steps involving unverified binaries.
[DATA_EXFILTRATION]: The belt CLI tool is designed to automatically upload local files to the vendor's cloud servers when local paths are provided in input fields (e.g., in the belt app run command as seen in references/running-apps.md). This functionality creates a risk of sensitive local data being exfiltrated if an agent is directed to process files from sensitive directories.
[PERSISTENCE]: The skill provides instructions in references/cli-reference.md for establishing shell completions by writing to system and user directories (such as /etc/bash_completion.d/ and ~/.config/fish/completions/), which allows the tool to maintain a persistent presence and execute within the user's shell environment.
[INDIRECT_PROMPT_INJECTION]: As the skill interacts with various third-party AI models and processes untrusted inputs, it presents an attack surface for indirect prompt injection.
- Ingestion points: The --input flag in the belt app run command in SKILL.md and references/running-apps.md allows processing of external JSON data and local files.
- Boundary markers: There are no explicit markers or instructions to ignore embedded commands in the ingested data.
- Capability inventory: The skill has capabilities for network access, file reading, and remote code execution.
- Sanitization: No sanitization or validation of input data is mentioned before it is sent to remote models.
[COMMAND_EXECUTION]: The skill relies on the Bash tool to execute belt CLI commands. While restricted to the belt command in the frontmatter, these commands interact with the network and local file system, providing high-capability primitives that could be misused.

agent-tools