inference-sh-cli
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
infshCLI tool fromhttps://cli.inference.sh. This is a vendor-owned domain used for providing the necessary tooling to interact with their service. - [REMOTE_CODE_EXECUTION]: Installation instructions include piping a remote script to the shell (
curl -fsSL https://cli.inference.sh | sh). While this is a sensitive pattern, it targets the vendor's official installation URL for the primary tool required by the skill. - [COMMAND_EXECUTION]: The skill makes extensive use of the
infshcommand-line utility to search for, configure, and execute AI models. This includes handling local file paths for uploads, which is a documented feature of the CLI tool. - [DATA_EXFILTRATION]: The skill is designed to upload user-specified local files (images, audio) to the inference.sh cloud for processing. This is the core intended purpose of the tool and is explicitly documented in the workflow.
Audit Metadata