The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation encourages installing the belt CLI using a pipe-to-shell pattern (curl -fsSL https://cli.inference.sh | sh). While this is the official installation method for the service, executing remote scripts directly from a URL is a high-risk pattern that can be exploited if the source is compromised.
[DATA_EXFILTRATION]: The CLI tool is designed to automatically upload local files to the platform's cloud servers when a file path is provided in an app's input parameters (e.g., belt app run ... --input '{"image": "/path/to/file.jpg"}'). This functionality presents a data exfiltration surface where sensitive local data (such as SSH keys or configuration files) could be uploaded to external servers if the agent is manipulated via prompt injection.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute belt CLI commands, allowing the agent to interact with the local operating system and the inference.sh API.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external sources, including search results from Tavily and Exa, and outputs from various LLMs (Claude, Gemini, Grok).
Ingestion points: Data enters the context via app results and search query outputs (SKILL.md, references/running-apps.md).
Boundary markers: None identified to separate model outputs from agent instructions.
Capability inventory: The agent can execute shell commands via Bash(belt *) and perform network operations through the CLI (SKILL.md).
Sanitization: No explicit sanitization or filtering of external content is mentioned before processing.

agent-tools