skills/inf-sh/skills/agent-tools/Gen Agent Trust Hub

agent-tools

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install its command-line interface by downloading and executing a script directly from the vendor's domain.
  • Evidence: curl -fsSL https://cli.inference.sh | sh in SKILL.md and references/authentication.md.
  • Context: The resource originates from the skill's official vendor. The documentation includes alternative manual installation steps that facilitate SHA-256 checksum verification and Sigstore signature validation.
  • [COMMAND_EXECUTION]: The skill interacts with the local environment by executing belt CLI commands through the agent's shell.
  • Evidence: Numerous examples such as belt app run, belt app list, and belt login are provided throughout the skill's documentation and reference files.
  • [DATA_EXFILTRATION]: The CLI tool includes a feature to upload local files to the inference.sh cloud infrastructure when a local path is provided instead of a URL in the input parameters.
  • Evidence: Described in SKILL.md and references/running-apps.md as an automatic behavior for processing local images, audio, or video files (e.g., belt app run falai/topaz-image-upscaler --input '{"image": "/path/to/photo.jpg"}').
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 10:16 AM
Security Audit — agent-trust-hub — agent-tools