The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation instructs users to install the CLI tool by piping a remote script directly to the shell (e.g., curl -fsSL https://cli.inference.sh | sh). This execution pattern provides no opportunity for review and could lead to arbitrary code execution if the distribution source is compromised.
[DATA_EXFILTRATION]: The belt CLI tool includes a feature that automatically reads and uploads local files when a file path is provided in the input parameters (e.g., belt app run ... --input '{"image": "/path/to/file"}'). This functionality creates a significant exfiltration surface, as a malicious prompt could trick the agent into uploading sensitive files such as SSH private keys, AWS credentials, or .env files to the cloud.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes and displays data from various external AI models and search providers.
Ingestion points: The agent ingests data from external AI applications and search providers (Tavily, Exa) via the belt app run command.
Boundary markers: No specific delimiters or warnings are provided to prevent the agent from following instructions embedded in the external outputs.
Capability inventory: The agent can execute shell commands and perform network-based file uploads using the belt CLI.
Sanitization: The skill lacks validation or sanitization mechanisms for the data returned by these external services.
[COMMAND_EXECUTION]: The skill's primary function is to execute the belt CLI tool in the shell to manage AI tasks and file uploads, granting the agent interaction with the local system environment.
[EXTERNAL_DOWNLOADS]: The instructions include commands to add additional dependencies using npx skills add, which fetches and executes code from external vendor namespaces at runtime.

infsh-cli