The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides installation commands in SKILL.md and references/authentication.md that pipe a remote script from the vendor's domain (https://cli.inference.sh) directly to the shell. While this is the official installer for the inference.sh CLI, piped shell execution remains a high-risk pattern.\n- [DATA_EXFILTRATION]: The CLI tool (belt) includes a feature for automatically uploading local files to the vendor's cloud service when a file path is provided as input. As described in SKILL.md and references/running-apps.md, this creates a potential exfiltration vector if the agent is tricked into reading sensitive files (e.g., credentials, keys) and passing them as arguments to the tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from both local files and external AI model outputs, presenting a surface for indirect prompt injection.\n
Ingestion points: Local file paths provided via the --input flag and external data returned from inference.sh app executions.\n
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the documentation for handling these inputs.\n
Capability inventory: The skill has access to the Bash tool to execute CLI commands, read local files for upload, and perform network operations via the inference.sh infrastructure.\n
Sanitization: There is no evidence of sanitization, validation, or escaping of external content before it is processed by the agent.\n- [COMMAND_EXECUTION]: The skill instructions encourage the execution of several CLI commands (belt login, belt app run, etc.) and shell completions, which allow the agent to interact directly with the host environment and remote services.

agent-tools