building-inferencesh-apps
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the platform's CLI tool using a pipe-to-shell pattern:
curl -fsSL https://cli.inference.sh | sh. This facilitates the installation of the vendor's own official tooling. - [REMOTE_CODE_EXECUTION]: Reference documentation includes installation commands for common development dependencies, such as
uvfromastral.sh,fnmfromfnm.vercel.app, andnvmfrom its official repository. These utilize standard remote script execution patterns (piped tosh,bash, orpowershell). - [EXTERNAL_DOWNLOADS]: The skill describes an application lifecycle that involves downloading packages from well-known registries like PyPI and NPM, and fetching model weights from the official Hugging Face Hub.
- [COMMAND_EXECUTION]: The skill relies on the
infshcommand-line utility for project scaffolding (infsh app init), testing (infsh app test), and deployment (infsh app deploy). These operations are consistent with the skill's stated purpose of platform-specific application development. - [CREDENTIALS_UNSAFE]: The documentation correctly guides users to manage sensitive information such as API keys and OAuth credentials through environment variables and the platform's integrated secret management system, rather than hardcoding them in source files.
Audit Metadata