The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to install the CLI using the command curl -fsSL https://cli.inference.sh | sh in SKILL.md and references/authentication.md. This pattern downloads a shell script from a remote URL and executes it directly, bypassing standard package management verification. The source cli.inference.sh belongs to the skill vendor.
[EXTERNAL_DOWNLOADS]: The CLI installation process downloads binary files, checksums, and manifests from dist.inference.sh. The skill also references npx skills add for installing related modules.
[DATA_EXFILTRATION]: The belt CLI is designed to read local files and upload them to the inference.sh cloud service. As documented in SKILL.md and references/running-apps.md, providing a local file path (e.g., /path/to/photo.jpg, ./my-image.png) as input to the tool triggers an automatic upload to external servers managed by the vendor.
[COMMAND_EXECUTION]: The skill requests permission for the Bash tool limited to the belt executable (Bash(belt *)), enabling the agent to execute any CLI command supported by the tool.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a vulnerability surface.
Ingestion points: Data returned from AI models, search engines, and social media apps executed via belt app run (found in SKILL.md and references/running-apps.md).
Boundary markers: None identified; there are no explicit instructions for the agent to ignore or delimit model-generated content.
Capability inventory: Execution of shell commands via the belt CLI and network-based file uploads.
Sanitization: No validation or sanitization steps are defined for the output of the AI apps before the agent incorporates them into its context.

agent-tools