The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions for the necessary CLI tool utilize a curl | sh pipe, which downloads and executes a script from an external domain (cli.inference.sh) directly in the host shell without verification.
Evidence: curl -fsSL https://cli.inference.sh | sh in SKILL.md.
[COMMAND_EXECUTION]: The skill leverages the infsh command-line tool to execute arbitrary logic. It specifically invokes remote applications (infsh/python-executor) to run Python code snippets defined within the skill's instructions.
Evidence: Multiple instances of infsh app run infsh/python-executor with embedded Python source code.
[EXTERNAL_DOWNLOADS]: The skill depends on fetching and running software from external domains and utilizes remote services for image generation and code execution.
Evidence: References to inference.sh for CLI tools and fal.ai for image generation models.
[PROMPT_INJECTION]: The skill processes user-supplied data, such as financial metrics and market figures, by interpolating them into code templates for execution. This creates an indirect prompt injection surface as there are no boundary markers or sanitization steps to prevent malicious data from manipulating the executed code.
Ingestion points: User-provided metrics for market size, traction, and competition charts.
Boundary markers: None.
Capability inventory: Shell command execution (infsh), remote Python execution, remote HTML/CSS rendering.
Sanitization: None.

pitch-deck-visuals