📦
Audit History
agent-tools - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 12, 2026, 09:41 AM | 6 confirmed | 2 | No capability change |
| v4 | Jul 12, 2026, 09:41 AM | 6 confirmed | 2 | No capability change |
| v3 | Jul 8, 2026, 02:16 PM | 6 confirmed | 28 | No capability change |
| v2 | Jul 9, 2026, 11:16 AM | 6 confirmed | 19 | No capability change |
| v1 | Jul 8, 2026, 02:16 PM | 6 confirmed | 28 | Baseline |
Audit version 5 Latest
Jul 12, 2026, 09:41 AM
The documentation contains four remote installer commands that pipe downloaded content directly into a shell, plus an unpinned package installation and a remote-data command substitution. Most other detections are Markdown examples, documentation links, placeholder credentials, or intentional user-selected paths. The skill also permits automatic cloud uploads and social account changes without requiring explicit confirmation.
5
Files scanned
599
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads mutable remote content and executes it immediately in a shell. A compromised host, route, or installer can execute arbitrary code.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command executes remote content without allowing local inspection or independent verification. Compromise of the delivery path would provide arbitrary shell execution.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command directly executes a script downloaded from the network. It provides no pre-execution inspection or independently pinned integrity check.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary setup instructions execute an unaudited network response directly in the user's shell. A delivery compromise would permit arbitrary code execution.
High
Unconfirmed Social Account Actions
The skill exposes commands that can publish posts and identifies direct messages, follows, likes, and reposts as available actions. It provides no requirement to preview or confirm these external side effects.
The listed capabilities directly modify a connected social account, while the skill contains no confirmation or preview guardrail.
Medium
Automatic Local File Upload Without Confirmation
The skill states that local paths are automatically uploaded to cloud apps, including absolute, parent-directory, and home-directory paths. It does not require confirmation before transferring user files.
Both files explicitly document automatic uploads from local paths to cloud applications, and neither includes a confirmation requirement.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The shell expands a URL parsed from a mutable remote manifest and passes it to curl. The same origin supplies checksums, so compromise can redirect and validate a malicious download.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline Markdown contains an actual npx installation command for an unpinned remote skill. Running it introduces package and skill supply-chain execution risk.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (21)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-103 SKILL.md:103-129 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 12, 2026, 09:41 AM
The documentation contains four remote installer commands that pipe downloaded content directly into a shell, plus an unpinned package installation and a remote-data command substitution. Most other detections are Markdown examples, documentation links, placeholder credentials, or intentional user-selected paths. The skill also permits automatic cloud uploads and social account changes without requiring explicit confirmation.
5
Files scanned
599
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command downloads mutable remote content and executes it immediately in a shell. A compromised host, route, or installer can execute arbitrary code.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command executes remote content without allowing local inspection or independent verification. Compromise of the delivery path would provide arbitrary shell execution.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The installation command directly executes a script downloaded from the network. It provides no pre-execution inspection or independently pinned integrity check.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary setup instructions execute an unaudited network response directly in the user's shell. A delivery compromise would permit arbitrary code execution.
High
Unconfirmed Social Account Actions
The skill exposes commands that can publish posts and identifies direct messages, follows, likes, and reposts as available actions. It provides no requirement to preview or confirm these external side effects.
The listed capabilities directly modify a connected social account, while the skill contains no confirmation or preview guardrail.
Medium
Automatic Local File Upload Without Confirmation
The skill states that local paths are automatically uploaded to cloud apps, including absolute, parent-directory, and home-directory paths. It does not require confirmation before transferring user files.
Both files explicitly document automatic uploads from local paths to cloud applications, and neither includes a confirmation requirement.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The shell expands a URL parsed from a mutable remote manifest and passes it to curl. The same origin supplies checksums, so compromise can redirect and validate a malicious download.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline Markdown contains an actual npx installation command for an unpinned remote skill. Running it introduces package and skill supply-chain execution risk.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (21)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-103 SKILL.md:103-129 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 8, 2026, 02:16 PM
AI review confirmed critical pipe-to-shell installer instructions and high-risk local binary installation guidance. Most API-key and Markdown backtick detections are documentation placeholders or command examples, but the skill still directs agents to run a networked CLI. Semantic review also found explicit local file uploads and Twitter/X automation that require strong user consent.
5
Files scanned
599
Lines analyzed
38
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote script directly to sh. Running it executes unaudited network content on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command pipes a remote script directly to sh. Running it executes unaudited network content on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote installer directly to sh. This is a critical supply-chain execution pattern.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote installer directly to sh. This is a critical pattern because network content executes immediately.
High
Cloud Upload of Local Files
The skill states that local file paths are uploaded automatically for media inputs. An agent could send sensitive local files to cloud apps without clear user review.
The files explicitly describe automatic local file uploads and show image, audio, and media path examples. This is direct evidence of cloud file transfer behavior.
High
Social Media Account Automation
The skill advertises Twitter/X posting, media posting, DMs, follows, likes, and retweets. Unreviewed agent execution could modify a connected account.
The cited lines list concrete Twitter/X actions including posting and related account operations. These are intentional capabilities with account-impacting effects.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The block shows belt app run commands that upload local images, audio, and media. This can send user files to cloud apps.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command substitution fetches a URL from a remote manifest and feeds it to curl. A changed manifest could redirect the download target.
High
Template literal with command substitution
> ```bash
The manual install block includes command substitution driven by remote manifest data. It is safer than curl-to-sh but still uses network-derived shell logic.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install moves a downloaded binary into ~/.local/bin, placing new executable code in the user PATH. This creates persistent execution risk.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline command tells users to install another skill through npx. This is not Ruby backtick execution, but it is a supply-chain command.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The fenced shell block contains remote installer and login commands. It is command execution guidance, even though the Markdown fence triggered the detector.
Medium
Ruby/shell backtick execution
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose describes a remote installer that downloads and installs binaries. It is not executable by itself, but it supports command execution workflow.
Medium
Ruby/shell backtick execution
> ```bash
The manual install block runs curl, checksum, tar, and move commands for a downloaded binary. It is legitimate install guidance but still executes external commands.
Medium
Ruby/shell backtick execution
| Browse the app store | `belt app store` |
The command browses the remote app store through the belt CLI. It is expected behavior, but it still invokes an external command.
Medium
Ruby/shell backtick execution
| Search apps | `belt app store search "flux"` |
The command searches the remote app store through the belt CLI. It is expected behavior, but it performs networked CLI execution.
Medium
Ruby/shell backtick execution
| Filter by category | `belt app store --category image` |
The command filters the remote app store through the belt CLI. This is legitimate but still networked command execution.
Medium
Ruby/shell backtick execution
| Get app details | `belt app get google/veo-3-1-fast` |
The command retrieves remote app details through the belt CLI. It is legitimate but still invokes an external service.
Medium
Ruby/shell backtick execution
| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |
The command contacts the app service and saves sample input to a local file. This combines external command execution with filesystem writes.
Medium
Ruby/shell backtick execution
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with a local input file. It can send prompts or file references to the external service.
Medium
Ruby/shell backtick execution
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
The command runs a cloud app asynchronously. It is expected behavior, but it still executes a networked task.
Medium
Ruby/shell backtick execution
| Check task status | `belt task get <task-id>` |
The command checks remote task status and retrieves cloud task results. It is a legitimate external command with network effects.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The same command writes into a hidden home directory during install. This is expected for local tools but still changes executable state.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:18
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
This points users to a hardcoded external installer endpoint. It is expected for setup, but it creates a remote supply-chain dependency.
Low
Hardcoded URL
"url": "https://cloud.inference.sh/...",
The example shows generated outputs hosted at a cloud.inference.sh URL. It reflects external cloud storage for results.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The Markdown embeds a remote image from cloud.inference.sh. Rendering it can trigger an external request, so the network dependency is real.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose links to the remote installer and describes downloaded binaries. This is a real external install endpoint.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install instructions download checksums from dist.inference.sh. This is an expected but real external network dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command fetches a remote manifest and binary URL. The command-substitution risk is tracked separately.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (21)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-103 SKILL.md:103-129 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 9, 2026, 11:16 AM
The skill is mostly documentation for the inference.sh belt CLI, but it includes confirmed critical curl-to-shell installer patterns and persistent binary installation guidance. Many Markdown links, API key placeholders, and shell-completion examples are benign, while local file uploads and social media automation create real data and account-action risks. No prompt injection attempt was found in the reviewed files.
5
Files scanned
599
Lines analyzed
29
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote script directly into sh. That pattern can execute arbitrary remote code before the user inspects it.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall path repeats the remote curl-to-shell pattern. Re-running an unaudited remote installer is still arbitrary code execution risk.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The install command pipes a remote HTTPS response directly to sh. This is a high-impact remote code execution pattern if the endpoint or transport is compromised.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The primary install instructions pipe a remote script directly to sh. This gives the remote endpoint immediate code execution on the user machine.
High
Local File Uploads Can Expose Workspace Data
The skill states that local files are automatically uploaded when file paths are provided. In agent workflows, this can send sensitive workspace or personal files to hosted apps without file-level review.
Both cited sections explicitly describe automatic local file uploads and show commands with local media paths. The privacy risk is direct, though it depends on user or agent-selected files.
Medium
Social Media Automation Can Perform Account Actions
The skill includes examples for posting to Twitter/X and lists actions such as direct messages, follows, likes, and retweets. These operations can affect external accounts if credentials are configured.
The cited lines directly name posting and other Twitter/X account actions. The risk is business-logic impact rather than code execution.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
- Relative paths: `./image.png`, `../data/video.mp4`
The document explicitly allows parent-directory relative paths for local file uploads. In an agent workflow, that can expose files outside the immediate workspace to cloud apps.
High
Ruby/shell backtick execution
> ```bash
The manual-install block contains downloads, checksum verification, archive extraction, and installation into PATH. These are real shell operations that install executable code.
High
Ruby/shell backtick execution
```bash
The block runs belt commands with local image, audio, and media paths that the CLI uploads to cloud apps. This creates a concrete data exposure risk if used without confirmation.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command uses shell substitution around a network-fetched manifest to select a download URL. This dynamic download path increases command execution and supply-chain risk.
High
Template literal with command substitution
> ```bash
The manual-install block includes command substitution and binary installation steps. The pattern is executable shell logic, not just a static reference.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The install instructions move a downloaded executable into ~/.local/bin. Installing an externally downloaded binary into PATH is persistent and security-sensitive.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline command installs an additional CLI skill using npx. That can modify the agent environment and adds supply-chain exposure.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The fenced block contains shell commands to install and log in to the CLI. It is a real command sequence, even though it is shown as documentation.
Medium
Ruby/shell backtick execution
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
The command submits an app run using an input file. This is intended behavior, but it can send user-provided data to a hosted service.
Medium
Ruby/shell backtick execution
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
The no-wait app run command submits external work without waiting for results. It can still send input data to a remote provider.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for executables. This is expected for manual install, but it still modifies persistent user environment state.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:18
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
The URL is used in a command that downloads an installer from a fixed external endpoint. The network dependency is visible, but it still fetches remote installation content.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The command downloads checksums from an external distribution host. This is an expected network fetch but still a real dependency in the install flow.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a remote manifest to derive a binary URL. This is a real network-driven install step with additional shell parsing risk.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (21)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-103 SKILL.md:103-129 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex
Jul 8, 2026, 02:16 PM
AI review confirmed critical pipe-to-shell installer instructions and high-risk local binary installation guidance. Most API-key and Markdown backtick detections are documentation placeholders or command examples, but the skill still directs agents to run a networked CLI. Semantic review also found explicit local file uploads and Twitter/X automation that require strong user consent.
5
Files scanned
599
Lines analyzed
38
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote script directly to sh. Running it executes unaudited network content on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The reinstall command pipes a remote script directly to sh. Running it executes unaudited network content on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote installer directly to sh. This is a critical supply-chain execution pattern.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The command pipes a remote installer directly to sh. This is a critical pattern because network content executes immediately.
High
Cloud Upload of Local Files
The skill states that local file paths are uploaded automatically for media inputs. An agent could send sensitive local files to cloud apps without clear user review.
The files explicitly describe automatic local file uploads and show image, audio, and media path examples. This is direct evidence of cloud file transfer behavior.
High
Social Media Account Automation
The skill advertises Twitter/X posting, media posting, DMs, follows, likes, and retweets. Unreviewed agent execution could modify a connected account.
The cited lines list concrete Twitter/X actions including posting and related account operations. These are intentional capabilities with account-impacting effects.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The block shows belt app run commands that upload local images, audio, and media. This can send user files to cloud apps.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command substitution fetches a URL from a remote manifest and feeds it to curl. A changed manifest could redirect the download target.
High
Template literal with command substitution
> ```bash
The manual install block includes command substitution driven by remote manifest data. It is safer than curl-to-sh but still uses network-derived shell logic.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install moves a downloaded binary into ~/.local/bin, placing new executable code in the user PATH. This creates persistent execution risk.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline command tells users to install another skill through npx. This is not Ruby backtick execution, but it is a supply-chain command.
Medium
Ruby/shell backtick execution · 3 occurrences
```bash
The fenced shell block contains remote installer and login commands. It is command execution guidance, even though the Markdown fence triggered the detector.
Medium
Ruby/shell backtick execution
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose describes a remote installer that downloads and installs binaries. It is not executable by itself, but it supports command execution workflow.
Medium
Ruby/shell backtick execution
> ```bash
The manual install block runs curl, checksum, tar, and move commands for a downloaded binary. It is legitimate install guidance but still executes external commands.
Medium
Ruby/shell backtick execution
| Browse the app store | `belt app store` |
The command browses the remote app store through the belt CLI. It is expected behavior, but it still invokes an external command.
Medium
Ruby/shell backtick execution
| Search apps | `belt app store search "flux"` |
The command searches the remote app store through the belt CLI. It is expected behavior, but it performs networked CLI execution.
Medium
Ruby/shell backtick execution
| Filter by category | `belt app store --category image` |
The command filters the remote app store through the belt CLI. This is legitimate but still networked command execution.
Medium
Ruby/shell backtick execution
| Get app details | `belt app get google/veo-3-1-fast` |
The command retrieves remote app details through the belt CLI. It is legitimate but still invokes an external service.
Medium
Ruby/shell backtick execution
| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |
The command contacts the app service and saves sample input to a local file. This combines external command execution with filesystem writes.
Medium
Ruby/shell backtick execution
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
The command runs a cloud app with a local input file. It can send prompts or file references to the external service.
Medium
Ruby/shell backtick execution
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
The command runs a cloud app asynchronously. It is expected behavior, but it still executes a networked task.
Medium
Ruby/shell backtick execution
| Check task status | `belt task get <task-id>` |
The command checks remote task status and retrieves cloud task results. It is a legitimate external command with network effects.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The same command writes into a hidden home directory during install. This is expected for local tools but still changes executable state.
Low
references/authentication.md:6references/authentication.md:44references/cli-reference.md:6SKILL.md:18
Hardcoded URL · 4 occurrences
curl -fsSL https://cli.inference.sh | sh
This points users to a hardcoded external installer endpoint. It is expected for setup, but it creates a remote supply-chain dependency.
Low
Hardcoded URL
"url": "https://cloud.inference.sh/...",
The example shows generated outputs hosted at a cloud.inference.sh URL. It reflects external cloud storage for results.
Low
Hardcoded URL
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwt
The Markdown embeds a remote image from cloud.inference.sh. Rendering it can trigger an external request, so the network dependency is real.
Low
Hardcoded URL
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and
The prose links to the remote installer and describes downloaded binaries. This is a real external install endpoint.
Low
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install instructions download checksums from dist.inference.sh. This is an expected but real external network dependency.
Low
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command fetches a remote manifest and binary URL. The command-substitution risk is tracked separately.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (21)
SKILL.md:7 SKILL.md:17-20 SKILL.md:20-22 SKILL.md:22-25 SKILL.md:25-34 SKILL.md:34-38 SKILL.md:38-56 SKILL.md:56-62 SKILL.md:62-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-103 SKILL.md:103-129 SKILL.md:28 SKILL.md:25-34
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern
Audited by: codex