The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill recommends installing the belt CLI by piping a script from a remote URL directly into a shell (curl -fsSL https://cli.inference.sh | sh). This is a high-risk pattern that executes unverified code from an external source with the user's local privileges.
[EXTERNAL_DOWNLOADS]: The skill documentation facilitates the download of binary files from dist.inference.sh and secondary skill components via npx skills add from the inference-sh and belt-sh namespaces. These sources are not categorized as trusted organizations or well-known services.
[COMMAND_EXECUTION]: The skill is configured to use the Bash tool with belt * permissions, enabling broad execution of the platform's CLI. This tool facilitates network operations, cloud resource management, and local file system interaction.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its ingestion and processing of untrusted data:
Ingestion points: Untrusted local file paths and input JSON provided as arguments to the belt app run command, as documented in references/running-apps.md.
Boundary markers: There are no specific boundary markers or 'ignore' instructions defined to prevent the agent from following malicious commands embedded in the files it processes.
Capability inventory: The CLI has the capability to read local files (including sensitive paths like ~/.ssh/ or .env files) and upload them to the inference.sh cloud service as part of its 'Local File Uploads' feature.
Sanitization: No evidence of path validation, sanitization, or filtering is provided for the file ingestion process.

infsh-cli