agent-tools

Fail

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill recommends installing the belt CLI via a remote shell script (curl piped to sh) from the vendor's domain. However, this risk is mitigated by the inclusion of comprehensive manual installation steps, which involve downloading binaries, verifying SHA-256 checksums, and validating Sigstore signatures.
  • [COMMAND_EXECUTION]: The skill enables the agent to use the Bash(belt *) tool to interact with the inference.sh ecosystem, allowing for the execution of AI models, app discovery, and automation of social media actions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied inputs and file paths that could contain malicious instructions.
  • Ingestion points: The --input parameter in belt app run commands accepts JSON strings and local file paths directly from the task context.
  • Boundary markers: There are no explicit delimiters or instructions provided to isolate these inputs from the agent's core logic.
  • Capability inventory: The permitted Bash(belt *) tool provides capabilities for network-based AI task execution and local file uploads to external infrastructure.
  • Sanitization: No input validation or sanitization mechanisms are described for the data processed by the CLI tool.
Recommendations
  • HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 2, 2026, 02:20 PM
Security Audit — agent-trust-hub — agent-tools