The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation recommends installing the CLI by piping a remote shell script from https://cli.inference.sh directly into a shell (curl | sh). While this is the official installation method for the vendor, executing remote scripts without prior inspection is a high-risk pattern.
[EXTERNAL_DOWNLOADS]: The installation process and manual setup instructions involve downloading executable binaries, manifest files, and checksums from the distribution domain https://dist.inference.sh.
[COMMAND_EXECUTION]: The skill operates by executing the belt command-line utility through a bash shell to perform tasks such as running AI models, searching for applications, and managing tasks.
[DATA_EXFILTRATION]: The belt CLI tool includes a feature for automatic local file uploads. When a local file path is provided in the input JSON (e.g., for image or video generation tasks), the tool reads the file from the local filesystem and transmits it to the inference.sh cloud infrastructure.
[INDIRECT_PROMPT_INJECTION]: The inclusion of the local file upload capability creates a surface for indirect prompt injection where a malicious prompt could attempt to trick the agent into uploading sensitive files by providing their paths as inputs to the CLI.
Ingestion points: User-controlled JSON input strings for application parameters in SKILL.md and references/running-apps.md.
Boundary markers: Absent. The instructions do not specify any constraints or validation rules to prevent the agent from accessing arbitrary file paths.
Capability inventory: The skill uses the belt CLI tool which has built-in capabilities to read local files and perform network operations to a remote cloud service.
Sanitization: Absent. The skill does not provide any logic for validating or sanitizing file paths before they are passed to the shell command.

infsh-cli