infsh-cli

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the belt CLI binary and related assets from cli.inference.sh and dist.inference.sh. These are the official domains for the inference.sh platform, matching the vendor's own infrastructure.
  • [REMOTE_CODE_EXECUTION]: The documentation includes a 'curl piped to shell' installation command (curl -fsSL https://cli.inference.sh | sh). While common in developer tools, this is a high-risk pattern. The skill provides a corresponding 'Manual Install' section with SHA-256 checksum verification and Sigstore/cosign support, which are recommended best practices for safety.
  • [COMMAND_EXECUTION]: The skill uses the Bash(belt *) tool to interact with the system. It demonstrates various commands for running AI applications, generating media, and managing deployments on the inference.sh platform. The 'Local File Upload' feature described (belt app run ... --input '{"image": "/path/to/photo.jpg"}') uses standard CLI functionality to read local files for processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 10:39 PM
Security Audit — agent-trust-hub — infsh-cli