Skills python-sdk
📦

python-sdk

Content revision r1 High Risk 📁 Filesystem access🔑 Env variables🌐 Network access⚡ Contains scripts⚙️ External commands

Build Python Apps with inference.sh SDK

Python teams need reliable patterns for inference.sh integrations. This skill explains SDK setup, async workflows, files, streaming, agents, and tool building.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "python-sdk" from https://skillstore.io/skills/inference-sh-9-python-sdk.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-python-sdk/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-9-python-sdk.md Signed manifest GET /api/skills/inference-sh-9-python-sdk/manifest Signed lockfile GET /api/skills/inference-sh-9-python-sdk/lockfile

Test it

Using "python-sdk". A developer asks how to run one inference.sh app from Python.

Expected outcome:

A concise setup path with package installation, API key handling, one app call, and result inspection steps.

Using "python-sdk". An agent engineer asks how to add tools to an assistant.

Expected outcome:

  • Recommended tool categories for the workflow.
  • Approval points for sensitive operations.
  • Notes about validating tool arguments before execution.

Using "python-sdk". A backend team asks how to process many jobs concurrently.

Expected outcome:

An async workflow outline with concurrency limits, timeout handling, retries, and result aggregation guidance.

Security Audit

High Risk
v4 • 7/6/2026 Open versioned report

Most static findings are documentation placeholders, Markdown code fences, SDK session identifiers, or expected file and network examples. The unsafe eval examples are confirmed because they evaluate agent-controlled tool-call arguments, and the skill manifest grants broad Bash access. No prompt injection indicators were found in the reviewed files.

7
Files scanned
2,395
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (1)

High
SKILL.md:4
Broad Command Permission in Skill Manifest
The skill manifest allows Bash(python *) in addition to package installation. This grants broad local Python execution capability when the skill is active, which increases the impact of unsafe examples or prompt-driven misuse.
The allowed-tools frontmatter explicitly includes Bash(python *), a broad command pattern. This is not a placeholder code block and directly affects the skill permission surface.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
references/tool-builder.md:255
Dynamic code evaluation with eval()
result = eval(call.args['expression'])
The example evaluates call.args["expression"] with eval, which is agent-controlled tool-call input. If copied, this creates arbitrary code execution in the host Python process.
High
references/tool-builder.md:365
Dynamic code evaluation with eval()
result = eval(call.args["expression"])
The example evaluates call.args["expression"] with eval, which is agent-controlled tool-call input. If copied, this creates arbitrary code execution in the host Python process.

Risk Factors

📁 Filesystem access (7)
references/agent-patterns.md:140 references/agent-patterns.md:157 references/files.md:277 references/files.md:281 references/files.md:154 references/files.md:181 references/files.md:291
🔑 Env variables (39)
references/agent-patterns.md:12 references/agent-patterns.md:50 references/agent-patterns.md:80 references/agent-patterns.md:106 references/agent-patterns.md:153 references/agent-patterns.md:191 references/agent-patterns.md:223 references/agent-patterns.md:255 references/async-patterns.md:12 references/async-patterns.md:29 references/async-patterns.md:61 references/async-patterns.md:82 references/async-patterns.md:100 references/async-patterns.md:124 references/async-patterns.md:167 references/async-patterns.md:201 references/async-patterns.md:217 references/async-patterns.md:243 references/async-patterns.md:244 references/async-patterns.md:248 references/async-patterns.md:270 references/async-patterns.md:300 references/async-patterns.md:346 references/async-patterns.md:363 references/files.md:12 references/files.md:166 references/sessions.md:18 references/sessions.md:266 references/streaming.md:18 references/streaming.md:100 references/streaming.md:144 references/streaming.md:163 references/tool-builder.md:183 references/tool-builder.md:313 SKILL.md:54 SKILL.md:22 SKILL.md:51 SKILL.md:54 SKILL.md:398
🌐 Network access (19)
references/files.md:153 references/files.md:108 references/sessions.md:104 references/tool-builder.md:172 references/tool-builder.md:181 references/tool-builder.md:338 references/tool-builder.md:172 references/tool-builder.md:338 SKILL.md:9 SKILL.md:11 SKILL.md:302 SKILL.md:385 SKILL.md:478 SKILL.md:479 SKILL.md:480 SKILL.md:481 SKILL.md:482 SKILL.md:483 SKILL.md:302
⚡ Contains scripts (4)
references/tool-builder.md:255 references/tool-builder.md:365 references/tool-builder.md:307-311 SKILL.md:238-241
⚙️ External commands (59)
SKILL.md:15-17 SKILL.md:17-19 SKILL.md:19-30 SKILL.md:30-34 SKILL.md:34-40 SKILL.md:40-46 SKILL.md:46-55 SKILL.md:55-63 SKILL.md:63-71 SKILL.md:71-75 SKILL.md:75-83 SKILL.md:83-87 SKILL.md:87-95 SKILL.md:95-101 SKILL.md:101-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-105 SKILL.md:105-106 SKILL.md:106-112 SKILL.md:112-119 SKILL.md:119-123 SKILL.md:123-143 SKILL.md:143-149 SKILL.md:149-165 SKILL.md:165-173 SKILL.md:173-188 SKILL.md:188-194 SKILL.md:194-222 SKILL.md:222-228 SKILL.md:228-229 SKILL.md:229-230 SKILL.md:230-231 SKILL.md:231-237 SKILL.md:237-254 SKILL.md:254-258 SKILL.md:258-267 SKILL.md:267-271 SKILL.md:271-281 SKILL.md:281-285 SKILL.md:285-294 SKILL.md:294-298 SKILL.md:298-309 SKILL.md:309-313 SKILL.md:313-333 SKILL.md:333-337 SKILL.md:337-352 SKILL.md:352-356 SKILL.md:356-369 SKILL.md:369-373 SKILL.md:373-389 SKILL.md:389-393 SKILL.md:393-415 SKILL.md:415-419 SKILL.md:419-430 SKILL.md:430-434 SKILL.md:434-449 SKILL.md:449-462 SKILL.md:462-474
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/inference-sh-9-python-sdk/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-9-python-sdk/security.svg)](https://skillstore.io/skills/inference-sh-9-python-sdk?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-9-python-sdk?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-python-sdk/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-9-python-sdk.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh-9. (2026). python-sdk security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-python-sdk/audits/4

BibTeX citation

@techreport{inference-sh-9-inference-sh-9-python-sdk-2026, author = {inference-sh-9}, title = {python-sdk security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/inference-sh-9-python-sdk/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "python-sdk security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "inference-sh-9" date-released: "2026-07-06" url: "https://skillstore.io/skills/inference-sh-9-python-sdk/audits/4" identifiers: - type: other value: "skillstore:inference-sh-9-python-sdk:audit:4" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
inference-sh-9 Recommended Current

inference-sh-9-python-sdk

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 10
Updated

2026-08-21

inferen-sh

inferen-sh-python-sdk

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Prototype AI App Calls

Learn how to run inference.sh apps from Python with inputs, outputs, and streaming progress.

Build Agent Workflows

Use agent, tool, session, and approval examples to design multi-step assistant workflows.

Integrate Files and Async Jobs

Apply file upload, download, concurrency, retry, and timeout patterns in backend services.

Try These Prompts

Start a Basic Client 
Show me the simplest safe way to install the inferencesh package, configure an API key, and run one app call.
Add Files and Streaming 
Help me design a Python workflow that uploads an image, runs an inference.sh app, streams progress, and saves the result safely.
Create an Agent with Tools 
Guide me through creating an inference.sh agent with a client tool, an app tool, and human approval for sensitive actions.
Review a Production Integration 
Review my planned inference.sh Python SDK architecture for async concurrency, session reuse, file handling, secrets, and tool-call safety.

Best Practices

  • Store API keys in environment variables or a secret manager, not in source files.
  • Require approval and argument validation for tools that write files, call webhooks, or run code.
  • Limit async concurrency and session lifetimes to control cost and resource usage.

Avoid

  • Do not copy examples that evaluate tool-call text as code.
  • Do not expose uploaded files publicly unless the workflow requires public access.
  • Do not send model or tool outputs to external webhooks without an allowlist and user approval.

Frequently Asked Questions

Does this skill install the Python SDK automatically?
No. It documents installation commands and usage patterns for the inferencesh package.
Can I use it with Claude, Codex, and Claude Code?
Yes. The report marks compatibility with Claude, Codex, and Claude Code.
Does it include async examples?
Yes. It covers async clients, streaming, concurrency limits, timeouts, retries, and web framework integration.
Does it cover file uploads?
Yes. It documents automatic uploads, manual uploads, file attachments, downloads, and temporary files.
Are the API keys in the examples real?
No. The examples use placeholders and also show environment variable based configuration.
What should I review before production use?
Review tool-call execution, webhook destinations, file permissions, API key handling, and any code execution settings.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/inference-sh-9/skills/tree/main/skills/python-sdk/

Ref

a06681402992ceae98ba04d54cfd4ab004862696

Maintenance freshness

7/23/2026

Usage

4 downloads · 137 views

File structure

📁 references/

📄 agent-patterns.md

📄 async-patterns.md

📄 files.md

📄 sessions.md

📄 streaming.md

📄 tool-builder.md

📄 SKILL.md