The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's primary installation method and update instructions recommend executing curl -fsSL https://cli.inference.sh | sh. This pattern downloads a script from a remote server and executes it directly in the shell environment, which is a significant security risk if the remote source is compromised.- [DATA_EXFILTRATION]: The belt CLI includes functionality to upload local files to the vendor's cloud infrastructure for AI processing. The documentation demonstrates that any input field accepting a URL can also take a local file path, including absolute paths and home directory references like ~/Pictures/photo.jpg. This provides a mechanism for transmitting local data to an external server.- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where an agent could be manipulated via external data to exfiltrate sensitive files. If an attacker controls the JSON input passed to the belt CLI, they could trick the agent into uploading configuration or credential files by providing their paths as model inputs.
Ingestion points: Prompt parameters and file paths in JSON inputs for belt app run commands found in SKILL.md and references/running-apps.md.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands within user data are present in the provided skill content.
Capability inventory: Use of the Bash tool to execute the belt CLI, which possesses file-read and network-upload capabilities.
Sanitization: The instructions do not describe any validation or sanitization of file paths before they are passed to the CLI tool.- [COMMAND_EXECUTION]: The skill requires the Bash tool and performs various shell operations for setup, authentication, and execution of AI tasks.- [PRIVILEGE_ESCALATION]: The CLI reference documentation provides instructions for installing shell completions by writing directly to /etc/bash_completion.d/, a system-level directory that typically requires administrative (root) privileges to modify.

agent-tools