building-inferencesh-apps
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads the belt CLI tool from cli.inference.sh, which is the vendor's official domain. It also fetches developer tools such as uv from astral.sh, fnm from fnm.vercel.app, and nvm from raw.githubusercontent.com. All these sources are official or well-known services.
- [REMOTE_CODE_EXECUTION]: The documentation provides commands to pipe remote scripts to shell interpreters for installing the CLI and its dependencies. This includes scripts from cli.inference.sh, astral.sh, and GitHub. These are standard installation methods for the tools involved.
- [PRIVILEGE_ESCALATION]: Provides instructions to use the ByPass execution policy in PowerShell to allow the installation of the uv package manager on Windows.
- [COMMAND_EXECUTION]: Instructs the agent to use the belt CLI for tasks like app init, app test, and app deploy, as well as standard package managers like npm and uv.
- [SAFE]: Secret management is handled via environment variables and the platform's built-in secrets/integrations system, avoiding hardcoded credentials.
Audit Metadata