building-inferencesh-apps
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation provides a command to install the platform's CLI tool by fetching a script from
https://cli.inference.shand piping it directly to the shell (| sh). - [REMOTE_CODE_EXECUTION]: Reference files include installation commands for third-party developer tools, such as the
uvpackage manager (https://astral.sh/uv/install.sh), the Fast Node Manager (https://fnm.vercel.app/install), and the Node Version Manager (https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh), all of which involve piping remote scripts to a shell. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of various external dependencies, including Python packages from PyPI and Node.js packages from npm, as part of the application development workflow.
- [COMMAND_EXECUTION]: The instructions guide the agent to perform multiple shell operations using the
beltCLI tool, such as initializing projects (belt app init), running local tests (belt app test), and deploying code to the cloud (belt app deploy). - [PROMPT_INJECTION]: The
SKILL.mdfile contains instructions for the agent to ignore specific local documentation or directory structures (e.g.,PROVIDER_STRUCTURE.md) that might contradict the primary scaffolding workflow, ensuring adherence to the platform's standard CLI methods.
Audit Metadata