infsh-cli
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the
beltCLI tool fromhttps://cli.inference.shandhttps://dist.inference.sh. These are identified as official vendor domains for the 'qu-skills' author, and the installation process includes security best practices such as SHA-256 checksum verification and Sigstore signature verification viacosign. - [COMMAND_EXECUTION]: The documentation includes several shell command examples for the
beltCLI (belt app run,belt app list,belt login). These commands are standard operations for the tool's primary purpose of interacting with the inference.sh platform. - [REMOTE_CODE_EXECUTION]: The skill documents a
curl | shinstallation pattern for the CLI. While this is a common pattern for developer tools, the skill also provides a manual installation method with explicit checksum verification, which is a recommended security practice. - [DATA_EXPOSURE]: The skill documents how the CLI handles local file uploads for processing (e.g., image upscaling). This is a core feature of the tool and requires the user to explicitly provide file paths in command arguments.
Audit Metadata