building-inferencesh-apps
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to install the platform CLI by downloading and executing a script directly in the shell:
curl -fsSL https://cli.inference.sh | sh. - [REMOTE_CODE_EXECUTION]: In the CLI reference file (
references/cli.md), instructions are provided to install several third-party development tools using remote script execution patterns: curl -LsSf https://astral.sh/uv/install.sh | sh(for the uv package manager)curl -fsSL https://fnm.vercel.app/install | bash(for the fnm node manager)curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash(for the nvm node manager)- [REMOTE_CODE_EXECUTION]: The skill describes a Windows installation method for the
uvtool that uses PowerShell to download and execute a script using theiex(Invoke-Expression) command:powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex". - [PRIVILEGE_ESCALATION]: The Windows installation command for the
uvtool includes the-ExecutionPolicy ByPassflag to override the default system execution policies during installation. - [COMMAND_EXECUTION]: The skill documentation describes extensive use of the
beltCLI tool for project lifecycle tasks including initialization, testing, and cloud deployment (belt app init,belt app test,belt app deploy). It also mentions the use ofpackages.txtto install system-level packages via theaptpackage manager on the target environment.
Audit Metadata