infsh-cli
Fail
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions utilize
curl -fsSL https://cli.inference.sh | shfor CLI installation. This pattern represents a critical security risk as it executes unverified code from a remote server directly in the shell environment. - [DATA_EXFILTRATION]: The
beltCLI tool automatically uploads local files when a file path is provided in an input field (e.g., inbelt app run). This mechanism provides a direct path for exfiltrating sensitive local files such as SSH keys, environmental secrets, or private documents to the cloud service if the agent is directed to process these paths. - [COMMAND_EXECUTION]: The skill's primary operation relies on executing the
beltCLI and various shell commands for installation and task management. - [PROMPT_INJECTION]: The skill processes untrusted user prompts for AI model execution without implementing sanitization or boundary markers, exposing the system to indirect prompt injection where malicious instructions could influence agent behavior. (Severity: LOW). 1. Ingestion points: User-supplied JSON input for
belt app runinSKILL.md. 2. Boundary markers: Not present. 3. Capability inventory: Shell command execution and network-based file uploads. 4. Sanitization: No sanitization or validation methods are described.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata