📦
web-search
70Search and Extract Web Research
Finding current web evidence can slow down research and agent workflows. This skill runs Tavily and Exa searches through belt for sourced answers and extracted content.
Research & Learning View
Skills infsh-cli
📦
infsh-cli
Content revision r1 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands
Run AI Apps with inference.sh CLI
AI workflows often require separate APIs for images, video, search, and language models. This skill helps Claude, Codex, and Claude Code discover and run inference.sh apps through the belt CLI.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "infsh-cli" from https://skillstore.io/skills/inference-skills-infsh-cli.md and its manifest at https://skillstore.io/api/skills/inference-skills-infsh-cli/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "infsh-cli". Find image generation options for a fast concept art workflow.
Expected outcome:
- A short list of matching image apps by speed and quality.
- A recommendation for the first model to test.
- Notes about required prompt fields and expected media output.
Using "infsh-cli". Run a long video generation task and check it later.
Expected outcome:
The assistant submits the task, records the task ID, checks status later, and summarizes the final video result location.
Using "infsh-cli". Prepare a safe local media upload.
Expected outcome:
- A request for approval before any local file is uploaded.
- A clear list of selected file paths.
- A warning when a path points outside the working directory.
Security Audit
Criticalv4 • 7/5/2026 Open versioned report
AI review confirmed critical supply-chain risk from curl-to-shell installer instructions and shell-derived binary downloads. Many Markdown backtick and documentation URL matches are false positives, but the skill also documents cloud uploads of local files and social media actions. No prompt injection attempt was found.
5
Files scanned
596
Lines analyzed
11
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The line pipes a remote installer directly into sh. A changed or intercepted network response would become executable code on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The line pipes a remote installer directly into sh. A changed or intercepted network response would become executable code on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The line pipes a remote installer directly into sh. A changed or intercepted network response would become executable code on the user machine.
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh
The line pipes a remote installer directly into sh. A changed or intercepted network response would become executable code on the user machine.
High
Automatic Local File Uploads to Cloud Apps
The instructions state that URL fields also accept local paths and that the CLI automatically uploads those files. This can expose sensitive local files to inference.sh if an agent selects paths without explicit user consent.
The files explicitly describe automatic upload of local paths, including absolute, parent-directory, and home-directory examples. The behavior is central to the documented workflow.
Medium
Automated Social Media Account Actions
The skill advertises Twitter/X automation and examples for posting media. Commands can post, send messages, follow, like, or retweet through external apps without a built-in confirmation step.
The capability is directly listed in the skill examples and available categories. Legitimate use is possible, but unintended account actions are a clear business-logic risk.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
- Relative paths: `./image.png`, `../data/video.mp4`
The documentation says parent-directory paths can be provided for cloud uploads. That can expose files outside the intended working directory if selected carelessly.
High
Shell command substitution
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The manual install command uses command substitution around a remote manifest and shell filters to choose a binary URL. If manipulated, it may download an unintended executable.
High
Template literal with command substitution
> ```bash
Although the static pattern names a template literal, this block contains shell substitution that derives a download URL from a remote manifest. That is a supply-chain install risk.
High
Hidden file in home directory
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The manual install flow moves a downloaded binary into ~/.local/bin, a user PATH location. Combined with remote downloads, this can persist an untrusted executable.
Medium
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is part of a CLI installer command that fetches executable content from inference.sh. This creates a network supply-chain dependency even if the domain appears intended.
Medium
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is part of a CLI installer command that fetches executable content from inference.sh. This creates a network supply-chain dependency even if the domain appears intended.
Medium
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is part of a CLI installer command that fetches executable content from inference.sh. This creates a network supply-chain dependency even if the domain appears intended.
Medium
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh
The URL is part of a CLI installer command that fetches executable content from inference.sh. This creates a network supply-chain dependency even if the domain appears intended.
Medium
Hardcoded URL
> curl -LO https://dist.inference.sh/cli/checksums.txt
The manual install instructions download checksum data from a hardcoded distribution host. This is expected but still part of the binary supply-chain flow.
Medium
Hardcoded URL
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep
The command fetches a remote manifest and uses it to download a CLI binary. This creates a supply-chain dependency on the manifest and distribution host.
Medium
Hidden file access
> mv inferencesh-cli-* ~/.local/bin/inferencesh
The command writes into a hidden home-directory path used for executables. This is normal for user installs, but it is still a persistence-sensitive filesystem change.
Risk Factors
🌐 Network access (17)
🔑 Env variables (3)
📁 Filesystem access (5)
⚙️ External commands (20)
Detected Patterns
Pipe to shell pattern×4
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/inference-skills-infsh-cli/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/inference-skills-infsh-cli?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/inference-skills-infsh-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-skills-infsh-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/inference-skills-infsh-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
inference-skills. (2026). infsh-cli security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-skills-infsh-cli/audits/4BibTeX citation
@techreport{inference-skills-inference-skills-infsh-cli-2026,
author = {inference-skills},
title = {infsh-cli security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/inference-skills-infsh-cli/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "infsh-cli security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "inference-skills"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/inference-skills-infsh-cli/audits/4"
identifiers:
- type: other
value: "skillstore:inference-skills-infsh-cli:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
9 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
inferen-sh Recommended
inferen-sh-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 40
Updated
2026-08-21
qu-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 18
Updated
2026-08-21
tool-belt-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 12
Updated
2026-08-21
skillssh-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
inference-skills Current
inference-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 8
Updated
2026-08-21
inference-sh-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
infsh-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 6
Updated
2026-08-21
101-skills-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 5
Updated
2026-08-21
halt-catch-fire-infsh-cli
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 3
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
68
Community
91
Spec Compliance
What You Can Build
Create Media Assets
Generate images, videos, audio, or avatars from a consistent CLI workflow.
Prototype AI Workflows
Compare app schemas, generate sample inputs, and test cloud AI tasks quickly.
Search and Analyze Information
Run hosted search and language apps for research, summaries, and structured answers.
Try These Prompts
Find Useful Apps
Use infsh-cli to find image generation apps for product mockups. Show useful options and explain when to choose each one.
Prepare Sample Input
Use infsh-cli to inspect google/veo-3-1-fast and create a sample input plan for a short product video. Ask before running it.
Run and Track a Task
Use infsh-cli to run falai/flux-dev-lora for this image idea: [describe image]. Track the task and summarize the result location.
Compare a Full Workflow
Use infsh-cli to compare two image apps and two video apps for a launch campaign. Include inputs, workflow steps, and safety checks.
Best Practices
- Inspect app details and sample inputs before running a new app.
- Ask for user approval before uploads, social actions, or long-running paid tasks.
- Store API keys securely and avoid placing secrets in prompts or saved input files.
Avoid
- Do not run installer commands from remote scripts without verification.
- Do not upload broad local paths, parent directories, or private files without consent.
- Do not post, message, follow, like, or retweet without a final user confirmation.
Frequently Asked Questions
What CLI does this skill use?
It uses the inference.sh belt CLI to discover apps, run tasks, and retrieve task results.
Do I need an inference.sh account?
Yes. Most commands require the CLI to be installed and authenticated with an account or API key.
Can it generate images and videos?
Yes. The references list image, video, audio, language, search, 3D, and utility app categories.
Can it use local files?
Yes. Some apps accept local paths, and the CLI uploads those files to cloud services.
Does it run models locally?
No. It submits jobs to inference.sh cloud apps and returns task outputs or hosted file links.
What should I confirm before running commands?
Confirm uploads, paid or long-running tasks, social media actions, and any installation or update command.
Developer Details
Author
inference-skillsLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
a25199bc7d6b82598536822d1738eb5d5f54025b
Maintenance freshness
7/18/2026
Usage
4 downloads · 87 views
File structure
More from inference-skills
View all📦
ai-image-generation
69Generate AI Images with Inference.sh
Image teams need quick access to many generation and editing models without writing provider-specific workflows. This skill supplies belt CLI examples for text-to-image, edits, upscaling, and model selection.
Design & Creative View
📦
ai-avatar-video
69Create AI Avatar Videos
Producing talking head videos often requires editing tools, voice generation, and model selection. This skill gives Claude, Codex, and Claude Code CLI workflows for avatar video generation.
Design & Creative View
📦
ai-video-generation
69Create AI Videos with Inference.sh
Video teams need fast access to many AI video models without memorizing each provider API. This skill guides Claude, Codex, and Claude Code through inference.sh belt commands for generation, editing, upscaling, and audio workflows.
Design & Creative View
📦
remotion-render
50Render Remotion Videos From React Code
Teams need fast video previews from React animation code without managing a local Remotion setup. This skill sends TSX to inference.sh and returns rendered MP4 outputs.
Design & Creative View
📦
agent-tools
38Run Inference.sh AI Apps from Agents
Agents often need a consistent way to find and run hosted AI apps. This skill teaches the inference.sh CLI workflow for discovery, inputs, execution, and task results.
Productivity View
Related Skills
View all📦
writingmate-mcp
80Compare AI Models and Generate Media
by writingmate
Choosing and testing AI models across separate services takes time. Writingmate connects an MCP host to model discovery, text comparison, image generation, and video generation.
Productivity View
📦
qwen-image-2-pro
79Generate Text-Rich Images with Qwen Pro
by inference-shell
Design teams need image prompts that preserve text and layout details. This skill guides Claude, Codex, or Claude Code to call Qwen-Image-2-Pro through inference.sh.
Design & Creative View
📦
ponyflash
78Generate and Edit AI Media with PonyFlash
by ponyflash
AI media work often spans separate generation, editing, and subtitle tools. PonyFlash combines SDK guidance with FFmpeg workflows for images, videos, speech, music, and exports.
Design & Creative View
📦
runcomfy-cli
78Run RunComfy Models from the CLI
by runcomfy-com
Teams need a repeatable way to run RunComfy media models from scripts. This skill guides CLI install, authentication, model runs, polling, and downloads.
Design & Creative View
📦
p-video
78Generate Pruna Videos from Text and Images
by inferen-sh
Creating video model commands requires choosing compatible inputs and settings. This skill guides Pruna P-Video and WAN generation through the inference.sh CLI.
Design & Creative View
📦
generating-storyboards
82Create Consistent Video Storyboards
by supercmohq
Video concepts can lose continuity when clips are planned separately. This skill creates sequential storyboard sheets that preserve characters, products, settings, and visual states.
Design & Creative View