Skills infsh-cli

📦

infsh-cli

Name: infsh-cli
Author: halt-catch-fire

Content revision r1 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands

Run AI Apps from the inference.sh CLI

AI teams often switch between many model APIs and tools. This skill guides Claude, Codex, and Claude Code through inference.sh CLI tasks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "infsh-cli" from https://skillstore.io/skills/halt-catch-fire-infsh-cli.md and its manifest at https://skillstore.io/api/skills/halt-catch-fire-infsh-cli/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/halt-catch-fire-infsh-cli.md Signed manifest GET /api/skills/halt-catch-fire-infsh-cli/manifest Signed lockfile GET /api/skills/halt-catch-fire-infsh-cli/lockfile

Test it

Using "infsh-cli". Find a fast video generation app for a mountain drone shot.

Expected outcome:

The assistant recommends a suitable video app, lists required input fields, estimates likely wait time, and asks before spending credits.

Using "infsh-cli". Turn my product photo into a short social clip.

Expected outcome:

The assistant confirms the local file path, selects an image-to-video app, describes the upload step, and waits for approval.

Using "infsh-cli". Check the result of my long-running generation task.

Expected outcome:

The assistant retrieves task status, summarizes progress, and explains where to find completed media links.

Security Audit

Critical

v4 • 7/9/2026 Open versioned report

The skill is a community CLI integration that intentionally runs external commands and contacts inference.sh services. The remote installer uses curl piped to sh in multiple files, and local file upload plus Twitter/X automation create high-impact side effects that require explicit user confirmation.

Files scanned

608

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

Critical

references/authentication.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command downloads a remote script and executes it immediately with sh. Users and agents cannot inspect or pin the installer before execution.

Critical

references/authentication.md:44

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall path repeats the same curl-to-shell installer pattern. This remains a critical supply-chain execution risk even if the endpoint is legitimate.

Critical

references/cli-reference.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The CLI reference repeats the curl-to-shell installer. Direct execution of remote installer code is a critical supply-chain pattern.

Critical

SKILL.md:18

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The primary install instruction pipes a remote script directly to sh. This is a critical remote-code execution and supply-chain pattern.

High

SKILL.md:58-73 references/running-apps.md:21-41

Automatic Local File Uploads to External Apps

The skill tells agents that the CLI automatically uploads local paths when supplied as inputs. This can disclose private files if a model selects paths without explicit user approval.

Both cited sections explicitly describe automatic uploads of local paths and show absolute, relative, and home-directory examples. The risk depends on user approval, but the capability is clearly documented.

High

SKILL.md:51-52 SKILL.md:98-99 SKILL.md:120-121

Social Media Account Actions

The skill includes Twitter/X posting, media posting, direct message, follow, like, and retweet workflows. These actions can affect external accounts and require explicit user confirmation.

The skill names concrete Twitter/X commands for posting and related account interactions. These are intentional capabilities, not just pattern matches.

High

SKILL.md:4 references/cli-reference.md:63-73

Broad Belt Command Permission

The skill grants Bash access to all belt subcommands, while the reference includes deployment and source-pull operations. This broad permission expands the blast radius beyond simple app execution.

The allowed-tools entry permits belt with any arguments, and the CLI reference documents development commands such as deploy and pull. The exact account impact depends on credentials, so confidence is high but not absolute.

Capability review items (27)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

SKILL.md:17-20

Ruby/shell backtick execution

```bash

The fenced shell block includes curl piped to sh followed by login. The installer step executes remotely downloaded code before local inspection.

High

SKILL.md:25-34

Ruby/shell backtick execution

> ```bash

The manual install block downloads remote assets, parses a remote manifest, verifies checksums, extracts an archive, and moves an executable into PATH. This is a legitimate install flow but has supply-chain and local persistence risk.

High

SKILL.md:62-74

Ruby/shell backtick execution

```bash

These commands run belt with local media paths that are automatically uploaded to external apps, and one example posts media to X/Twitter. That creates data disclosure and account-action risk.

High

SKILL.md:28

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command builds a download URL from a remote manifest using shell command substitution. Even in documentation, this dynamic install pattern is risky and hard to audit.

High

SKILL.md:25-34

Template literal with command substitution

> ```bash

The manual install block contains dynamic command substitution inside a remote download flow. This makes the installer path less transparent and increases supply-chain risk.

High

SKILL.md:33

Hidden file in home directory

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The manual install flow moves a downloaded executable into ~/.local/bin, placing persistent code in the user PATH. It is user-directed but has real local persistence impact.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line instructs users to install another skill through npx, which performs a network package operation. This is legitimate setup guidance but carries supply-chain risk.

Medium

SKILL.md:38-56

Ruby/shell backtick execution

```bash

The quick examples run hosted apps through belt, including web search and Twitter posting. These external CLI actions can create network and account side effects.

Medium

SKILL.md:74-80

Ruby/shell backtick execution

```

The range transitions into a command table and includes a remote app-store operation. The pattern is broad, but it does point to external CLI activity.

Medium

SKILL.md:80-81

Ruby/shell backtick execution

| Browse the app store | `belt app store` |

The belt app store command queries the public app store over the network. There is no injection evidence, but it is still external command execution.

Medium

SKILL.md:81-82

Ruby/shell backtick execution

| Search the store | `belt app store search "flux"` |

The store search command sends a user query to the external service. This is intended behavior, but it is a real networked CLI operation.

Medium

SKILL.md:82-83

Ruby/shell backtick execution

| Filter by category | `belt app store --category image` |

Filtering the remote app store still invokes the external belt CLI service. The risk is limited but the command has network side effects.

Medium

SKILL.md:83-84

Ruby/shell backtick execution

| List your apps | `belt app list` |

Listing user apps queries account-specific remote data through belt. This can expose workspace metadata to the agent and terminal output.

Medium

SKILL.md:84-85

Ruby/shell backtick execution

| Get app details | `belt app get google/veo-3-1-fast` |

Getting app details calls the external service for app metadata and schemas. It is expected functionality but remains a networked CLI action.

Medium

SKILL.md:85-86

Ruby/shell backtick execution

| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |

Generating a sample input can fetch app schema data and write an input file locally. This is legitimate but still an external command with filesystem effects.

Medium

SKILL.md:86-87

Ruby/shell backtick execution

| Run app | `belt app run google/veo-3-1-fast --input input.json` |

Running an app submits user-provided inputs to a hosted service. This is the core feature, but it can transmit data and incur external side effects.

Medium

SKILL.md:87-88

Ruby/shell backtick execution

| Run without waiting | `belt app run <app> --input input.json --no-wait` |

Running without waiting submits a background task to the hosted service. This can transmit data and consume account resources asynchronously.

Medium

SKILL.md:88-104

Ruby/shell backtick execution

| Check task status | `belt task get <task-id>` |

Checking task status retrieves remote task data and results through the external CLI. It is intended, but it remains account-scoped external command execution.

Medium

SKILL.md:104-130

Ruby/shell backtick execution

```bash

The related skills block uses npx commands to install multiple additional remote skills. That expands the trusted code surface and introduces package supply-chain risk.

Medium

SKILL.md:33

Hidden file access

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The same install flow writes into a hidden home-directory path. This is normal for user binaries, but it still modifies persistent executable search paths.

Low

references/authentication.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is used in a curl pipeline to a shell installer, so it drives network download for executable code. The hardcoded domain is expected for setup but still creates remote code supply-chain risk.

Low

references/authentication.md:44

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is used in a reinstall command that pipes a remote script to the shell. This is an expected installer endpoint, but it is still executable network content.

Low

references/cli-reference.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The hardcoded URL appears inside the CLI installation command that executes remote content. It is legitimate setup documentation but still a network execution dependency.

Low

SKILL.md:18

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is used in the curl-to-shell install command. The endpoint is expected, but it directly supplies executable installer content.

Low

SKILL.md:22

Hardcoded URL

> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and

The link points to the install script discussed by the setup instructions. It is not execution by itself, but it supports the remote installer flow.

Low

SKILL.md:27

Hardcoded URL

> curl -LO https://dist.inference.sh/cli/checksums.txt

The command downloads checksums from a hardcoded distribution endpoint during manual install. This is legitimate verification support but still an external install dependency.

Low

SKILL.md:28

Hardcoded URL

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command fetches a remote manifest to select an installer artifact. This is an external dependency in an installation flow.

Risk Factors

🌐 Network access (17)

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 references/running-apps.md:152 SKILL.md:9 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:27 SKILL.md:28 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146 SKILL.md:147

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (22)

Detected Patterns

Pipe to shell pattern×4

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/halt-catch-fire-infsh-cli/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/halt-catch-fire-infsh-cli/security.svg)](https://skillstore.io/skills/halt-catch-fire-infsh-cli?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/halt-catch-fire-infsh-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/halt-catch-fire-infsh-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/halt-catch-fire-infsh-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

halt-catch-fire. (2026). infsh-cli security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/halt-catch-fire-infsh-cli/audits/4

BibTeX citation

@techreport{halt-catch-fire-halt-catch-fire-infsh-cli-2026,
  author = {halt-catch-fire},
  title = {infsh-cli security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/halt-catch-fire-infsh-cli/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "infsh-cli security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "halt-catch-fire"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/halt-catch-fire-infsh-cli/audits/4"
identifiers:
  - type: other
    value: "skillstore:halt-catch-fire-infsh-cli:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

9 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

inferen-sh Recommended

inferen-sh-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 75

Updated

2026-09-09

qu-skills

qu-skills-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 51

Updated

2026-09-09

tool-belt

tool-belt-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 46

Updated

2026-09-09

skillssh

skillssh-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 41

Updated

2026-09-09

inference-skills

inference-skills-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 41

Updated

2026-09-09

infsh-skills

infsh-skills-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 40

Updated

2026-09-09

inference-sh-skills

inference-sh-skills-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 40

Updated

2026-09-09

halt-catch-fire Current

halt-catch-fire-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 31

Updated

2026-09-09

101-skills

101-skills-infsh-cli

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create Media Assets

Generate images, videos, avatars, audio, and 3D assets through hosted model apps.

Evaluate Model Workflows

Discover apps, inspect schemas, run samples, and compare model outputs from one CLI workflow.

Run Approved External Actions

Use search apps or approved Twitter/X workflows after confirming prompts, media, and account actions.

Try These Prompts

Find an App

Find an inference.sh app for image generation. Show the best options and explain which one fits my prompt.

Run a Simple Task

Use inference.sh to generate one image from this prompt. Ask before running any command that spends credits.

Use Local Media Safely

Prepare an image-to-video run using my local file. Confirm the exact file path with me before upload.

Orchestrate Multi-Step Work

Plan a workflow that searches the web, drafts a media prompt, runs a video model, and tracks the task until completion.

Best Practices

Confirm app names, inputs, costs, and account-changing actions before running commands.
Use sample inputs and app schemas before submitting expensive or long-running jobs.
Review every local file path before allowing the CLI to upload files.