building-inferencesh-apps

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs users to install the platform CLI by downloading and executing a script directly in the shell: curl -fsSL https://cli.inference.sh | sh.
  • [REMOTE_CODE_EXECUTION]: In the CLI reference file (references/cli.md), instructions are provided to install several third-party development tools using remote script execution patterns:
  • curl -LsSf https://astral.sh/uv/install.sh | sh (for the uv package manager)
  • curl -fsSL https://fnm.vercel.app/install | bash (for the fnm node manager)
  • curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash (for the nvm node manager)
  • [REMOTE_CODE_EXECUTION]: The skill describes a Windows installation method for the uv tool that uses PowerShell to download and execute a script using the iex (Invoke-Expression) command: powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex".
  • [PRIVILEGE_ESCALATION]: The Windows installation command for the uv tool includes the -ExecutionPolicy ByPass flag to override the default system execution policies during installation.
  • [COMMAND_EXECUTION]: The skill documentation describes extensive use of the belt CLI tool for project lifecycle tasks including initialization, testing, and cloud deployment (belt app init, belt app test, belt app deploy). It also mentions the use of packages.txt to install system-level packages via the apt package manager on the target environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 08:14 PM
Security Audit — agent-trust-hub — building-inferencesh-apps