The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md and references/authentication.md direct the user to execute a remote script using curl -fsSL https://cli.inference.sh | sh. This pattern is a high-risk vector for executing arbitrary code from an unverified external source.
[EXTERNAL_DOWNLOADS]: The skill downloads binary executables from dist.inference.sh during the installation process. While the documentation mentions SHA-256 verification and Sigstore signatures, the initial script used to facilitate this is fetched from an unverified remote domain.
[COMMAND_EXECUTION]: Instructions in references/cli-reference.md for shell completions (e.g., belt completion bash > /etc/bash_completion.d/infsh) involve writing to system-level directories. This typically requires elevated privileges (sudo) and can be used to achieve persistence or modify system behavior.
[DATA_EXFILTRATION]: The belt CLI tool features automatic local file uploads. As documented in references/running-apps.md, providing a local file path (e.g., /path/to/photo.jpg or ~/.ssh/id_rsa if misused) to the --input argument results in the file being uploaded to the inference.sh cloud infrastructure. This creates a significant data exposure surface if the agent is prompted to process sensitive local files.

infsh-cli