python-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and examples for using the
inferenceshPython SDK. All external references and domains (e.g., inference.sh, Cloudflare for images, Google/Tavily for model references) are related to the service's core functionality. - [COMMAND_EXECUTION]: The skill includes instructions to install the SDK via
pip install inferencesh, which is the standard and expected way to use the library. It also includes examples of code execution patterns using built-in agent capabilities, which are documented as features for AI assistants. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the SDK handles API keys and file uploads, these are standard operations for a cloud-based AI service. The documentation correctly recommends using environment variables for API keys (
os.environ["INFERENCE_API_KEY"]) and provides clear examples for manual and automatic file handling to the provider's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection through tools that ingest external data (e.g.,
web_search,search-assistant, and reading files). However, the documentation emphasizes human-in-the-loop patterns and approval workflows (require_approval(),on_tool_call) to mitigate risks associated with autonomous actions.
Audit Metadata