The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill promotes an insecure installation method by piping a remote script directly into a shell environment.
Evidence: curl -fsSL https://cli.inference.sh | sh found in SKILL.md and references/authentication.md.
[DATA_EXFILTRATION]: The CLI tool is configured to automatically upload local files to remote cloud infrastructure whenever a local path is provided in the application input. This provides a direct path for the exfiltration of sensitive data if an agent is instructed to process restricted files (e.g., SSH keys, credentials).
Evidence: Documentation in references/running-apps.md states: "The CLI automatically uploads local files when you provide a file path instead of a URL."
[EXTERNAL_DOWNLOADS]: The skill performs multiple downloads of binaries and metadata from remote servers without using pre-verified trusted sources.
Evidence: curl -LO https://dist.inference.sh/cli/checksums.txt and curl -fsSL https://dist.inference.sh/cli/manifest.json in SKILL.md.
[COMMAND_EXECUTION]: The skill requests broad execution permissions for the belt CLI tool via the Bash tool, enabling the agent to perform a wide range of cloud operations and local file interactions.
Evidence: allowed-tools: Bash(belt *) in SKILL.md.
[PRIVILEGE_ESCALATION]: Instructions included for shell completion setup require writing to system directories (/etc/), which necessitates elevated privileges.
Evidence: belt completion bash > /etc/bash_completion.d/infsh in references/cli-reference.md.
[PROMPT_INJECTION]: The skill possesses a data ingestion surface (Indirect Prompt Injection) that allows the interpolation of local file paths into commands that perform network uploads, without apparent sanitization or boundary markers.
Ingestion points: The --input flag in belt app run commands.
Boundary markers: Absent.
Capability inventory: File read and network upload via the belt CLI.
Sanitization: Absent.

agent-tools