agent-tools
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install its command-line interface by downloading and executing a script directly from the vendor's domain.
- Evidence:
curl -fsSL https://cli.inference.sh | shinSKILL.mdandreferences/authentication.md. - Context: The resource originates from the skill's official vendor. The documentation includes alternative manual installation steps that facilitate SHA-256 checksum verification and Sigstore signature validation.
- [COMMAND_EXECUTION]: The skill interacts with the local environment by executing
beltCLI commands through the agent's shell. - Evidence: Numerous examples such as
belt app run,belt app list, andbelt loginare provided throughout the skill's documentation and reference files. - [DATA_EXFILTRATION]: The CLI tool includes a feature to upload local files to the inference.sh cloud infrastructure when a local path is provided instead of a URL in the input parameters.
- Evidence: Described in
SKILL.mdandreferences/running-apps.mdas an automatic behavior for processing local images, audio, or video files (e.g.,belt app run falai/topaz-image-upscaler --input '{"image": "/path/to/photo.jpg"}').
Audit Metadata