The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md and references/authentication.md recommend piping a remote script to the shell using curl -fsSL https://cli.inference.sh | sh. This allows for the execution of unvetted remote code with the user's current privileges.
[EXTERNAL_DOWNLOADS]: The skill downloads binary executables from dist.inference.sh during the installation process as described in SKILL.md.
[COMMAND_EXECUTION]: The skill is configured with allowed-tools: Bash(belt *), granting the agent authority to execute the belt CLI tool with arbitrary arguments. This allows the agent to perform actions such as running cloud apps, searching the store, and managing tasks.
[DATA_EXFILTRATION]: The belt CLI includes built-in functionality to automatically upload local files to the inference.sh cloud infrastructure when a file path is provided in an input field (e.g., belt app run ... --input '{"image": "/path/to/photo.jpg"}'). This creates a significant risk where an attacker could use indirect prompt injection to trick the agent into uploading sensitive files like credentials or configuration files to the external service.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from external AI app outputs and search results.
Ingestion points: Data from the inference.sh platform enters the context via belt app run outputs, belt task get results, and belt app store search queries, as documented in references/running-apps.md and references/app-discovery.md.
Boundary markers: None are present in the instructions to help the agent distinguish between trusted instructions and untrusted data from tool outputs.
Capability inventory: The agent has the capability to write files to disk (--save) and upload any local file to the network via the belt tool.
Sanitization: There is no evidence of output sanitization or validation of the data retrieved from the remote platform before it is presented to the agent.

agent-tools