infsh-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to install the CLI tool by piping a remote script directly into the shell (
curl -fsSL https://cli.inference.sh | sh). The documentation states that this script performs architecture detection, checksum verification, and signature verification before installation. - [DATA_EXFILTRATION]: The CLI tool is designed to automatically upload local files (images, videos, audio) to the vendor's cloud platform (
inference.sh) whenever a local file path is provided as an input argument for an AI application. - [COMMAND_EXECUTION]: The skill configuration restricts the
Bashtool to thebeltcommand namespace, allowing the agent to execute specific CLI functions for running and managing AI tasks. - [PRIVILEGE_ESCALATION]: Instructions for setting up shell completions include writing to system-level directories such as
/etc/bash_completion.d/, which typically requires root or sudo privileges. - [EXTERNAL_DOWNLOADS]: The installation process fetches binary files from
dist.inference.shand provides a manual installation path that involves downloading manifest and checksum files.
Audit Metadata