The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill promotes an installation pattern in SKILL.md and references/authentication.md where a remote script is fetched and piped directly into the shell: curl -fsSL https://cli.inference.sh | sh. This method allows for arbitrary remote code execution without prior inspection of the script's contents.
[DATA_EXFILTRATION]: The skill's primary functionality includes the belt app run command, which is designed to upload local files (e.g., images, audio, video) to the inference.sh infrastructure for processing. This creates a documented path for local system data to be transmitted to external servers.
[PRIVILEGE_ESCALATION]: The references/cli-reference.md file provides instructions for setting up shell completions that write to system-level directories, such as /etc/bash_completion.d/infsh. Modifying these paths typically requires elevated (root) privileges, and malicious modifications to shell completion scripts can lead to persistent privilege escalation.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by ingesting data from external AI models and web search tools.
Ingestion points: Data enters the agent context through the outputs of belt app run (e.g., tavily/search-assistant or x/post-tweet).
Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions embedded within the retrieved data.
Capability inventory: The skill has the capability to execute shell commands (belt), read local files for upload, and perform network requests.
Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed by the agent.

infsh-cli