The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent/user to install the core CLI tool by piping a remote script directly into the shell: curl -fsSL https://cli.inference.sh | sh. This is a high-risk pattern that executes unverified code from an external server without manual review or checksum verification during the primary installation path.
[DATA_EXFILTRATION]: The belt CLI tool contains an 'automatic upload' feature. If a local file path is provided in an input parameter instead of a URL, the tool reads the file from the local disk and uploads it to the inference.sh cloud. This behavior creates a significant data exfiltration risk if the agent is manipulated into processing sensitive paths such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env files.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data (prompts and file paths) and interpolates them into commands executed by the belt CLI.
Ingestion points: Untrusted data enters the context through input JSON strings in SKILL.md and references/running-apps.md used with the belt app run command.
Boundary markers: None identified in the provided instructions to separate instructions from untrusted data.
Capability inventory: The skill uses the Bash tool to run the belt CLI, which has capabilities for network access, file reading, file uploading, and cloud deployment.
Sanitization: No evidence of input validation or sanitization before passing parameters to the CLI.
[COMMAND_EXECUTION]: The skill facilitates the execution of the belt CLI, which provides access to a wide range of external services and AI models, including capabilities for Twitter automation, web searching, and executing remote 'apps' that could perform varied tasks.
[PERSISTENCE_MECHANISMS]: The CLI reference documentation in references/cli-reference.md includes commands to write shell completion scripts to system-protected or configuration directories like /etc/bash_completion.d/ and ~/.config/fish/completions/. While intended for usability, modifying these paths is a common persistence technique.

infsh-cli