The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions in SKILL.md and references/authentication.md recommend curl -fsSL https://cli.inference.sh | sh. This pattern downloads a shell script from a remote server and executes it directly on the local machine. While provided by the vendor, this method bypasses package management security controls and executes arbitrary remote code.
[DATA_EXFILTRATION]: The belt CLI tool features an automatic file upload capability described in SKILL.md and references/running-apps.md. When a local path is provided instead of a URL in the --input JSON (e.g., "image": "/path/to/photo.jpg"), the tool reads the local file and transmits it to the vendor's cloud servers. This capability could be exploited to exfiltrate sensitive files (such as SSH keys or credentials) if an agent is tricked into targeting them.
[PRIVILEGE_ESCALATION]: The CLI reference in references/cli-reference.md suggests installing shell completions by writing directly to system directories like /etc/bash_completion.d/. This operation typically requires root privileges and involves modifying system-wide configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and data to generate inputs for the belt CLI, creating a surface for injection attacks.
Ingestion points: User-provided prompts, query strings, and input JSON values used in belt app run commands across all reference files.
Boundary markers: Absent; instructions demonstrate direct interpolation of user strings into command-line arguments.
Capability inventory: The skill uses the belt CLI which has network access, local file read/upload access, and account authentication capabilities.
Sanitization: No explicit sanitization or validation of user-provided paths or JSON structure is described.

infsh-cli