infsh-cli
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an installation script hosted at
https://cli.inference.sh. This is the official domain for the vendor's command-line interface. - [REMOTE_CODE_EXECUTION]: The installation instructions utilize a pattern of piping a remote script directly to the shell (
curl | sh). While this is a sensitive operation, it is the vendor's documented method for tool deployment from their own infrastructure. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to executebeltcommands for interacting with the inference.sh API, managing AI tasks, and querying model availability. The skill's configuration appropriately restricts theBashtool to only allowbeltcommands. - [DATA_EXFILTRATION]: The CLI tool includes a feature to automatically upload local files (such as images, video, and audio) to the vendor's cloud infrastructure for processing. This behavior is documented as the primary mechanism for media-related AI workflows.
Audit Metadata