Skills javascript-sdk

📦

javascript-sdk

Name: javascript-sdk
Author: inference-sh-9

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access⚡ Contains scripts

Build JavaScript AI Apps with inference.sh

JavaScript teams need clear patterns for calling inference.sh from apps and services. This skill provides SDK setup, app execution, streaming, file, agent, and proxy guidance.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "javascript-sdk" from https://skillstore.io/skills/inference-sh-9-javascript-sdk.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-javascript-sdk/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-9-javascript-sdk.md Signed manifest GET /api/skills/inference-sh-9-javascript-sdk/manifest Signed lockfile GET /api/skills/inference-sh-9-javascript-sdk/lockfile

Test it

Using "javascript-sdk". Help me add the SDK to a Next.js app without exposing an API key.

Expected outcome:

A backend proxy route, frontend client setup, environment variable guidance, and deployment checklist.

Using "javascript-sdk". Design an agent that can calculate values and notify a team channel.

Expected outcome:

A tool plan with typed parameters, validation, approval before notifications, and no dynamic code execution.

Using "javascript-sdk". Add file upload support for an image inference workflow.

Expected outcome:

A file handling flow for browser files and server paths, with upload, task execution, and result handling steps.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown examples, JavaScript template literals, placeholder URLs, and documented SDK configuration. I confirmed the eval-based tool handler examples as real high-risk patterns because agent tool input can reach dynamic code execution. I also found overbroad Bash permissions in the skill metadata, which should be narrowed before publication.

Files scanned

3,958

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:4

Overbroad Command Permissions in Skill Metadata

The skill front matter grants Bash access for npm, npx, node, pnpm, and yarn commands. A documentation skill does not need broad Node and package-manager execution permissions, and npx can run remote package code.

The allowed-tools line directly grants broad command patterns. This is a real permission-surface risk even though the surrounding content is mainly documentation.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/tool-builder.md:240

Dynamic code evaluation with eval()

result = eval(call.args.expression);

The example evaluates call.args.expression with eval inside an agent tool handler. Tool arguments can be model or user influenced, so copied code could allow arbitrary code execution.

High

references/tool-builder.md:387

Dynamic code evaluation with eval()

const result = eval(call.args.expression);

The example evaluates call.args.expression with eval inside an agent tool handler. Tool arguments can be model or user influenced, so copied code could allow arbitrary code execution.

Risk Factors

⚙️ External commands (111)

📁 Filesystem access (16)

references/agent-patterns.md:153 references/agent-patterns.md:159 references/agent-patterns.md:166 references/agent-patterns.md:129 references/files.md:139 references/files.md:141 references/files.md:153 references/files.md:155 references/files.md:236 references/files.md:249 references/files.md:272 references/files.md:278 references/files.md:412 references/files.md:417 SKILL.md:350 SKILL.md:352

🔑 Env variables (76)

🌐 Network access (26)

⚡ Contains scripts (4)

references/tool-builder.md:240 references/tool-builder.md:387 references/typescript.md:316 references/typescript.md:320

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/inference-sh-9-javascript-sdk/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-9-javascript-sdk/security.svg)](https://skillstore.io/skills/inference-sh-9-javascript-sdk?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-9-javascript-sdk?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-javascript-sdk/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-9-javascript-sdk.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh-9. (2026). javascript-sdk security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-javascript-sdk/audits/4

BibTeX citation

@techreport{inference-sh-9-inference-sh-9-javascript-sdk-2026,
  author = {inference-sh-9},
  title = {javascript-sdk security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/inference-sh-9-javascript-sdk/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "javascript-sdk security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "inference-sh-9"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/inference-sh-9-javascript-sdk/audits/4"
identifiers:
  - type: other
    value: "skillstore:inference-sh-9-javascript-sdk:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

inferen-sh Recommended

inferen-sh-javascript-sdk

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 36

Updated

2026-09-09

inference-sh-9 Current

inference-sh-9-javascript-sdk

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add AI features to a React app

Use browser upload patterns, hooks, and proxy setup to add image or text inference safely.

Build a Node.js inference service

Use typed SDK calls, streaming progress, sessions, and file handling in server-side workflows.

Design tool-using AI agents

Create agents with typed tools, approval gates, app tools, webhook tools, and reusable skills.

Try These Prompts

Install the SDK

Help me add @inferencesh/sdk to a JavaScript project and make one basic inference.sh app call.

Protect Browser API Keys

Show me how to use the inference.sh JavaScript SDK from a Next.js app without exposing my API key.

Stream Task Progress

Design a TypeScript flow that starts an inference.sh task and displays streaming progress to users.

Create a Safe Agent Tool

Build an inference.sh agent tool pattern that validates inputs, avoids eval, and asks for user approval before external actions.

Best Practices

Keep API keys on the server and route browser traffic through a backend proxy.
Validate every agent tool argument and replace eval with a constrained parser or explicit operations.
Pin app references, handle task failures, and test streaming behavior before release.

Avoid

Do not place secret API keys in public frontend environment variables.
Do not copy eval-based calculator examples into production tools.
Do not allow agents to call external services without approval and audit logging.