The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions consistently recommend installing the belt CLI by piping a remote shell script directly into the system shell: curl -fsSL https://cli.inference.sh | sh. This execution pattern prevents user review of the script's contents before execution and can lead to arbitrary code execution if the remote source is compromised. This finding is corroborated by automated security scans.
[COMMAND_EXECUTION]: The skill requires the Bash tool to execute belt CLI commands. The CLI performs complex operations including authenticated API calls, task management, and local file handling.
[DATA_EXFILTRATION]: The belt CLI contains a feature that automatically detects local file paths provided in its input JSON and uploads them to external cloud infrastructure (e.g., belt app run falai/topaz-image-upscaler --input '{"image": "/path/to/photo.jpg"}'). This functionality presents a risk where sensitive local files (such as SSH keys or environment secrets) could be exfiltrated if the agent is directed to process paths to such files.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted input and its powerful file-handling capabilities. An attacker could embed malicious instructions in data processed by the agent to trigger the CLI's file-upload feature against sensitive local files. 1. Ingestion points: Input JSON and arguments for the belt app run command in SKILL.md and references/running-apps.md. 2. Boundary markers: Absent; instructions do not provide delimiters or warnings to ignore instructions within the input data. 3. Capability inventory: The belt CLI, as documented, can read and upload any local file accessible to the user. 4. Sanitization: Absent; the skill does not specify any validation or escaping for the paths or JSON inputs provided to the CLI.

agent-tools