Skills agent-tools

📦

agent-tools

Name: agent-tools
Author: halt-catch-fire

Content revision r1 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands

Run AI Apps with Inference CLI

Teams often need several hosted AI models, but switching APIs slows routine work. This skill guides Claude, Codex, and Claude Code through belt CLI workflows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "agent-tools" from https://skillstore.io/skills/halt-catch-fire-agent-tools.md and its manifest at https://skillstore.io/api/skills/halt-catch-fire-agent-tools/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/halt-catch-fire-agent-tools.md Signed manifest GET /api/skills/halt-catch-fire-agent-tools/manifest Signed lockfile GET /api/skills/halt-catch-fire-agent-tools/lockfile

Test it

Using "agent-tools". Search for fast video generation apps.

Expected outcome:

Three matching apps are listed with provider, category, and expected prompt fields.
The response recommends one app for speed and one app for quality.
No job is submitted until the user approves a specific app.

Using "agent-tools". Run an image upscaling job with my approved file.

Expected outcome:

The assistant confirms the exact file path, submits the selected app, reports the task identifier, and returns the result link when ready.

Using "agent-tools". Create a research summary using search and an LLM.

Expected outcome:

The assistant selects search and language apps, asks before remote execution, then summarizes sources and generated findings.

Security Audit

Critical

v3 • 7/6/2026 Open versioned report

The audit confirms critical risk from repeated remote installer commands that pipe fetched content into a shell. Most placeholder API key, documentation link, and benign path examples are false positives, but the skill also documents local file uploads and Twitter or X account actions that need explicit user control.

Files scanned

599

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

references/authentication.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes content fetched from a remote URL directly into sh. That can execute arbitrary installer code if the endpoint or transport is compromised.

Critical

references/authentication.md:44

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall instruction repeats the remote pipe-to-shell pattern. It creates the same arbitrary code execution risk during update or recovery.

Critical

references/cli-reference.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The installation example pipes a remote script directly into sh. This is a high-risk installer pattern because fetched content executes immediately.

Critical

SKILL.md:18

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The install instruction executes remote content immediately through sh. This is a classic high-risk pattern for arbitrary code execution during setup.

High

SKILL.md:58-74 references/running-apps.md:21-42

Sensitive Local File Upload Capability

The skill says the CLI automatically uploads local file paths to remote apps, including image, audio, and media examples. An agent could expose local data if it selects paths without explicit user approval.

Both cited sections explicitly describe automatic local file uploads and show local path inputs. The risk is contextual data exposure, not just a path syntax match.

Medium

SKILL.md:51-52 SKILL.md:98 SKILL.md:119-120

Social Media Account Action Automation

The skill advertises Twitter or X posting and account actions, including posts, media creation, direct messages, follows, likes, and retweets. These actions can affect user accounts and can enable spam or unauthorized activity if run without review.

The cited lines show a posting example, list account-action app names, and link a Twitter automation skill. The abuse risk depends on credentials and user approval, so severity is medium.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:25-34

Ruby/shell backtick execution

> ```bash

The manual install block downloads artifacts, evaluates command substitution from a remote manifest, extracts an archive, and moves a binary into PATH. Those are real external command and supply-chain risks.

High

SKILL.md:28

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

This command substitution derives a download URL from a remote manifest and passes it to curl. Remote manifest contents influence what binary is downloaded.

High

SKILL.md:25-34

Template literal with command substitution

> ```bash

The manual install snippet combines remote downloads, command substitution, archive extraction, and installing a binary into PATH. This is a real supply-chain execution risk.

High

SKILL.md:33

Hidden file in home directory

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The manual install moves a downloaded binary into ~/.local/bin, adding an external executable to the user PATH. This is a standard location but a real trust risk.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line tells users to run npx to install another skill, which can execute package manager code and modify the agent environment. This is expected setup, but it is a real supply-chain action.

Medium

SKILL.md:17-20

Ruby/shell backtick execution

```bash

The bash block includes a remote installer and a login command. Even though it is documentation, it guides execution of external commands during setup.

Medium

SKILL.md:38-56

Ruby/shell backtick execution

```bash

The quick examples run cloud apps and include a Twitter post command, so they can send prompts or account actions to external services. The commands are core functionality but still security-relevant.

Medium

SKILL.md:62-74

Ruby/shell backtick execution

```bash

The local file upload examples run belt commands that send local image, audio, or media paths to remote apps. This can expose local data if used without confirmation.

Medium

SKILL.md:85-86

Ruby/shell backtick execution

| Run app | `belt app run google/veo-3-1-fast --input input.json` |

The command runs a remote app using local input, which may transmit data and incur side effects depending on the app. It is intended functionality but security-relevant.

Medium

SKILL.md:86-87

Ruby/shell backtick execution

| Run without waiting | `belt app run <app> --input input.json --no-wait` |

The no-wait command submits a remote job in the background, so it can continue consuming resources after the agent returns. It should require clear user intent.

Medium

SKILL.md:103-129

Ruby/shell backtick execution

```bash

The related-skills block tells users to run multiple npx skill installation commands. Installing additional skills can expand agent capabilities and supply-chain exposure.

Medium

SKILL.md:33

Hidden file access

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The command writes an installed binary under a hidden home-directory path. It is normal user-local installation, but it changes executable state.

Low

references/authentication.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

This URL is fetched as part of an installer command, so users must trust a remote endpoint before installing software. The network call is expected, but it is a real supply-chain trust boundary.

Low

references/authentication.md:44

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

This reinstall command fetches the installer from an external URL. It is intended setup behavior, but it still depends on remote code delivery.

Low

references/cli-reference.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is used in the CLI installation command. It is expected for setup, but it introduces an external software delivery dependency.

Low

SKILL.md:18

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is fetched as the source of a pipe-to-shell installer. The network destination is expected, but it is part of a real installer trust boundary.

Low

SKILL.md:27

Hardcoded URL

> curl -LO https://dist.inference.sh/cli/checksums.txt

This command downloads a checksum file from an external distribution host as part of manual install. The network access is expected but part of the software supply chain.

Low

SKILL.md:28

Hardcoded URL

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

This command fetches a remote manifest to choose a binary download URL. The network response influences the installation flow.

Risk Factors

🌐 Network access (17)

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 references/running-apps.md:152 SKILL.md:9 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:27 SKILL.md:28 SKILL.md:140 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (21)

Detected Patterns

Pipe to shell pattern×4

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/halt-catch-fire-agent-tools/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/halt-catch-fire-agent-tools/security.svg)](https://skillstore.io/skills/halt-catch-fire-agent-tools?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/halt-catch-fire-agent-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/halt-catch-fire-agent-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/halt-catch-fire-agent-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

halt-catch-fire. (2026). agent-tools security audit report (audit version 3) [Author version unspecified]. Skillstore. https://skillstore.io/skills/halt-catch-fire-agent-tools/audits/3

BibTeX citation

@techreport{halt-catch-fire-halt-catch-fire-agent-tools-2026,
  author = {halt-catch-fire},
  title = {agent-tools security audit report (audit version 3)},
  institution = {Skillstore},
  year = {2026},
  number = {3},
  url = {https://skillstore.io/skills/halt-catch-fire-agent-tools/audits/3},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agent-tools security audit report (audit version 3)"
version: "unspecified"
type: report
authors:
  - name: "halt-catch-fire"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/halt-catch-fire-agent-tools/audits/3"
identifiers:
  - type: other
    value: "skillstore:halt-catch-fire-agent-tools:audit:3"
    description: "Skillstore immutable audit report identifier"

Compare variants

20 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

tul-sh Recommended

tul-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 27

Updated

2026-08-21

toolshell

toolshell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 24

Updated

2026-08-21

inferen-sh

inferen-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 15

Updated

2026-08-21

tool-belt

tool-belt-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

inferencesh

inferencesh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 12

Updated

2026-08-21

inference-sh-skills

inference-sh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

inference-sh-7

inference-sh-7-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

inf-sh

inf-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

inference-skills

inference-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

inference-sh-9

inference-sh-9-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

inference-sh-3

inference-sh-3-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

skillssh

skillssh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

qu-skills

qu-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

infsh-skills

infsh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

inference-sh-0

inference-sh-0-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

inference-sh-6

inference-sh-6-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

inference-shell

inference-shell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

101-skills

101-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

inference-sh-8

inference-sh-8-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

halt-catch-fire Current

halt-catch-fire-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prototype Multimodal Workflows

Discover image, video, audio, search, and LLM apps, then compare inputs and outputs from one CLI flow.

Automate Media Generation Tasks

Run hosted image, video, upscaling, avatar, and utility apps without managing local GPU infrastructure.

Run Research Jobs from an Agent

Use search and LLM apps from an agent session, then track task status and retrieve result links.

Try These Prompts

Find an App

Use agent-tools to search the inference.sh app store for image generation apps. Show three options and the required inputs.

Run a Simple Job

Use agent-tools to prepare a small text-to-image job with my prompt. Ask before submitting the remote job.

Track a Long Job

Use agent-tools to submit a video generation job without waiting. Then show status checks and result retrieval steps.

Build a Multistep Workflow

Use agent-tools to discover apps, generate sample inputs, run an image-to-video workflow, and summarize every remote action before execution.

Best Practices

Ask for explicit approval before installing CLIs, uploading files, or posting to external services.
Generate sample inputs before running unfamiliar apps.
Pin app versions for repeatable workflows when available.

Avoid

Do not pipe remote installers into a shell in unattended workflows.
Do not upload broad directories or sensitive local files as app inputs.
Do not use social media actions without user-reviewed text and account confirmation.