The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md and references/authentication.md direct the agent to execute a remote script via curl -fsSL https://cli.inference.sh | sh. Piped shell execution from remote sources is a critical security risk.
[DATA_EXFILTRATION]: The belt app run command, documented in SKILL.md and references/running-apps.md, is designed to automatically upload local files to the cloud when a path is provided. This functionality can be abused to exfiltrate sensitive files, such as ~/.ssh/id_rsa or .env files, if the agent is manipulated into referencing them.
[COMMAND_EXECUTION]: The skill reference files (references/cli-reference.md) include commands for writing shell completions to /etc/bash_completion.d/infsh. This pattern involves writing to system directories, which typically requires elevated privileges and acts as a persistence mechanism.
[EXTERNAL_DOWNLOADS]: The skill fetches binaries, manifests, and checksums from dist.inference.sh during the manual installation process described in SKILL.md.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it ingests untrusted local data (via belt app run) and passes it to external AI services without boundary markers or sanitization, potentially allowing external content to influence agent behavior.

infsh-cli