agent-tools
Fail
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends installing the belt CLI via a remote shell script (curl piped to sh) from the vendor's domain. However, this risk is mitigated by the inclusion of comprehensive manual installation steps, which involve downloading binaries, verifying SHA-256 checksums, and validating Sigstore signatures.
- [COMMAND_EXECUTION]: The skill enables the agent to use the Bash(belt *) tool to interact with the inference.sh ecosystem, allowing for the execution of AI models, app discovery, and automation of social media actions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied inputs and file paths that could contain malicious instructions.
- Ingestion points: The --input parameter in belt app run commands accepts JSON strings and local file paths directly from the task context.
- Boundary markers: There are no explicit delimiters or instructions provided to isolate these inputs from the agent's core logic.
- Capability inventory: The permitted Bash(belt *) tool provides capabilities for network-based AI task execution and local file uploads to external infrastructure.
- Sanitization: No input validation or sanitization mechanisms are described for the data processed by the CLI tool.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
Audit Metadata