The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash(belt *) tool and subprocess.run in Python to execute the belt CLI for AI operations. It also provides examples of modifying crontab and writing to system log directories like /var/log/, which are standard for automation but involve sensitive system commands.
[EXTERNAL_DOWNLOADS]: The skill references several external resources and installation scripts hosted on inference.sh domains and its official GitHub repository (e.g., https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md). These are documented as part of the setup for the intended CLI tool.
[DATA_EXFILTRATION]: One example script (monitored_workflow.sh) demonstrates sending command results and error messages to an external webhook (https://your-webhook.com/alert). While presented as an alerting mechanism, this pattern could be misused to exfiltrate data if configured with a malicious endpoint.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It features multiple scripts that ingest untrusted data (e.g., $(cat $file) in data_processing.sh or $INPUT_TEXT in conditional_workflow.sh) and interpolate this data directly into LLM prompts without sanitization or boundary markers.
Ingestion points: Files in ./data/raw and shell arguments.
Boundary markers: None; data is directly concatenated into prompt strings.
Capability inventory: Uses belt CLI to call external models and writes output to the local file system.
Sanitization: None present in the examples.

ai-automation-workflows