The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides installation instructions that pipe a remote script directly into a shell (e.g., curl -fsSL https://cli.inference.sh | sh). This pattern executes unverified code from a remote server without manual review.
[DATA_EXFILTRATION]: The infsh CLI tool automatically uploads local files when a path is provided in the input parameters (e.g., infsh app run ... --input '{"image": "/path/to/local/file"}'). While intended for functionality, this provides a mechanism for an agent to exfiltrate sensitive local files to the vendor's cloud infrastructure.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run the infsh CLI, manage tasks, and configure shell environments. It includes instructions to write completion scripts to system directories like /etc/bash_completion.d/.
[CREDENTIALS_UNSAFE]: The documentation encourages users to set the INFSH_API_KEY environment variable for automation. This practice makes the secret key accessible to the agent process and potentially other processes in the environment.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes data from external AI applications via the infsh tool.
Ingestion points: Data returned from remote AI apps (e.g., app results, task statuses) entered the agent context through the infsh CLI.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands in the data returned from the remote apps.
Capability inventory: The agent has access to the Bash tool, allowing it to execute shell commands, read/write files, and perform network operations.
Sanitization: No evidence of sanitization or validation of the content returned from remote apps before it is processed by the agent.

agent-tools