building-inferencesh-apps

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation provides a command to install the platform's CLI tool by fetching a script from https://cli.inference.sh and piping it directly to the shell (| sh).
  • [REMOTE_CODE_EXECUTION]: Reference files include installation commands for third-party developer tools, such as the uv package manager (https://astral.sh/uv/install.sh), the Fast Node Manager (https://fnm.vercel.app/install), and the Node Version Manager (https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh), all of which involve piping remote scripts to a shell.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of various external dependencies, including Python packages from PyPI and Node.js packages from npm, as part of the application development workflow.
  • [COMMAND_EXECUTION]: The instructions guide the agent to perform multiple shell operations using the belt CLI tool, such as initializing projects (belt app init), running local tests (belt app test), and deploying code to the cloud (belt app deploy).
  • [PROMPT_INJECTION]: The SKILL.md file contains instructions for the agent to ignore specific local documentation or directory structures (e.g., PROVIDER_STRUCTURE.md) that might contradict the primary scaffolding workflow, ensuring adherence to the platform's standard CLI methods.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 02:15 AM
Security Audit — agent-trust-hub — building-inferencesh-apps