infsh-cli
Fail
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends installing its core CLI tool by piping a remote script to the shell (
curl -fsSL https://cli.inference.sh | sh). This is a high-risk pattern that executes unverified code from the internet. Evidence: Found in SKILL.md and references/authentication.md. - [DATA_EXFILTRATION]: The
beltCLI automatically uploads local files when a path is provided to the --input flag. This creates a potential exfiltration surface where sensitive files (e.g., ~/.ssh/id_rsa, .env) could be uploaded to the cloud if the agent is directed to use these paths by an attacker. Evidence: references/running-apps.md section 'Local File Uploads'. - [COMMAND_EXECUTION]: The skill uses the
beltCLI via shell tools and provides instructions for writing to system-wide paths like /etc/bash_completion.d/, which can be abused for persistence or privilege escalation. Evidence: references/cli-reference.md section 'Shell Completions'. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from search providers (Tavily, Exa) and uses it to construct command inputs without sanitization. 1. Ingestion points: Results from tavily/search-assistant and exa/search referenced in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Local file access and remote task execution via the belt CLI. 4. Sanitization: Absent.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata