javascript-sdk

SUSPICIOUS: the main SDK package and official inference.sh API usage are coherent and mostly benign, but the skill contains inconsistent transitive install instructions—especially `npx skills add belt-sh/cli`, which does not match inference.sh’s documented same-org CLI distribution. The skill is not confirmed malware, but it expands trust to unrelated or additional skills in a way disproportionate to a JavaScript SDK guide.