# Build Apps with the inference.sh JavaScript SDK

JavaScript teams need clear patterns for adding hosted AI tasks and agents. This skill provides SDK guidance for execution, streaming, files, tools, sessions, and proxies.

## Install

```bash
npx skillstore add inferen-sh/javascript-sdk
```

## Metadata

- Status: approved
- Slug: inferen-sh-javascript-sdk
- Skillstore revision: r2
- Version status: missing
- Tree hash: 6c492e59433f2d265811c7a24ff84bbf89c50ed089e6690dffb1c9a852187b62
- Author: inferen-sh
- GitHub username: inferen-sh
- License: MIT
- Repository: https://github.com/inferen-sh/skills/tree/main/sdk/javascript-sdk/
- Ref: 4121de961d1b6f2ffca856260e239505c302452c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access, network, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/inferen-sh-javascript-sdk
- Manifest: https://skillstore.pages.dev/api/skills/inferen-sh-javascript-sdk/manifest

## Capabilities

- Explains installation and authentication for the @inferencesh/sdk package.
- Shows synchronous, asynchronous, and streaming AI application execution.
- Guides template-based and custom agents with tool calls and approval workflows.
- Covers file uploads, generated file downloads, sessions, and conversation state.
- Provides server proxy patterns for Next.js, Express, Hono, Remix, and SvelteKit.
- Documents TypeScript types, React integration, error handling, and tool construction.

## Use Cases

- Add AI Tasks to Node.js: Create a typed server integration that runs inference.sh applications and handles results, errors, and files.
- Build a Streaming React Interface: Connect a React or Next.js interface through a server proxy and display incremental task progress.
- Create an Approved Tool Agent: Design an agent with typed tools, sessions, and human confirmation for sensitive external actions.

## Prompt Templates

### Install and Run a Task

```
Set up @inferencesh/sdk in my Node.js project. Show a minimal task call using a server-side environment variable and explain each required value.
```

### Add Streaming Progress

```
Convert my inference.sh task call to streaming mode. Handle status updates, partial output, completion, and errors without blocking the interface.
```

### Integrate a Secure Next.js Proxy

```
Add an inference.sh proxy to my Next.js App Router project. Keep the API key server-side and include authentication, input validation, and rate limiting.
```

### Design a Controlled Agent Workflow

```
Design a TypeScript inference.sh agent with typed tools and persistent sessions. Require approval for external actions, avoid eval, and define audit logging and failure handling.
```

## Limitations

- Requires an inference.sh account, API key, network access, and compatible application identifiers.
- Examples require security review before production use, especially eval, webhooks, and browser credentials.
- The skill does not guarantee model availability, pricing, response quality, or application schema stability.
- Framework examples are reference patterns and may need adaptation for existing authentication and deployment systems.

## Best Practices

- Keep API keys in private server environments and expose browser clients only through authenticated proxies.
- Validate tool arguments and require approval for filesystem, code execution, and external network actions.
- Pin dependencies, handle streamed failures, and record task identifiers for operational tracing.

## Anti Patterns

- Do not evaluate model-generated expressions or tool arguments with eval.
- Do not place inference credentials in NEXT\_PUBLIC variables or browser bundles.
- Do not allow unrestricted webhooks, package commands, or destructive tools without validation and approval.

## Security Audit

- Audited at: 2026-08-06T10:35:57.094\+00:00
- Summary: Most static matches are documentation syntax or legitimate SDK examples, including template literals, file operations, and server-side environment configuration. Confirmed risks include direct eval of agent input, an unpinned external skill install, broad package execution permissions, agent-callable webhooks, and a browser-exposed API key example.

## Stats

- Views: 134
- Downloads: 10
- Favorites: 0
- Popularity score: 0