Skills agent-tools

📦

agent-tools

Name: agent-tools
Author: qu-skills

Content revision r1 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands

Run Cloud AI Apps with belt

AI app workflows often require many separate provider tools. This skill guides Codex, Claude, and Claude Code through belt commands for discovery, execution, and task tracking.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "agent-tools" from https://skillstore.io/skills/qu-skills-agent-tools.md and its manifest at https://skillstore.io/api/skills/qu-skills-agent-tools/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/qu-skills-agent-tools.md Signed manifest GET /api/skills/qu-skills-agent-tools/manifest Signed lockfile GET /api/skills/qu-skills-agent-tools/lockfile

Test it

Using "agent-tools". Find a cloud app for generating a product image.

Expected outcome:

The skill returns candidate image apps, summarizes each schema, and recommends the safest app to run for the requested asset.

Using "agent-tools". Run a long video generation job and check it later.

Expected outcome:

The skill submits the task, records the task identifier, and later reports the task status and available output links.

Using "agent-tools". Use a local image as input for an upscaling workflow.

Expected outcome:

The skill warns that the file will upload to a cloud app, asks for confirmation, then uses the selected file path.

Security Audit

Critical

v4 • 7/5/2026 Open versioned report

The audit confirms critical installer risk from multiple curl-to-shell examples and high-risk handling of local file paths that can be uploaded to cloud apps. Most API-key and documentation-link matches are false positives, but the skill still performs external CLI operations, remote app execution, and account automation. No prompt injection attempt was found in the reviewed files.

Files scanned

599

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (6)

Critical

references/authentication.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command pipes a remote script directly into sh. If the remote endpoint or transport path is compromised, arbitrary shell code can execute.

Critical

references/authentication.md:44

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The reinstall instructions repeat curl piped directly to sh. This preserves the same remote code execution and supply-chain risk.

Critical

references/cli-reference.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The CLI installation command executes a remote script through sh. This is a classic high-impact supply-chain pattern.

Critical

SKILL.md:18

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The skill prominently instructs users to pipe a remote installer directly into sh. This is a direct remote-code-execution supply-chain hazard.

High

SKILL.md:58-73 references/running-apps.md:21-42

Implicit Local File Upload to Cloud Apps

The skill explains that local file paths are automatically uploaded to cloud apps, including photos, audio, and media paths. An agent could disclose user files if it supplies paths without explicit approval.

Both cited sections explicitly describe automatic local file uploads and show local media paths. This is a clear data-disclosure risk when used by an autonomous agent.

High

SKILL.md:51-52 SKILL.md:98 SKILL.md:119-120

External Account Action Automation

The skill includes Twitter/X workflows for posting, media creation, direct messages, follows, likes, and retweets. Those actions can mutate external accounts and public content if run without explicit user consent.

The referenced lines show concrete posting examples and list account actions. The risk depends on available credentials, but the capability is explicit.

Capability review items (19)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/running-apps.md:41

Path traversal sequence

- Relative paths: `./image.png`, `../data/video.mp4`

The running-apps guide says local paths are automatically uploaded, then permits ../ parent-directory paths. That can expose files outside the working directory if an agent uses it carelessly.

High

SKILL.md:62-74

Ruby/shell backtick execution

```bash

The block shows belt commands that pass local image, audio, and media paths to cloud apps. Those commands can upload user files outside the model context.

High

SKILL.md:28

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command substitution fetches a remote manifest and uses local system details to choose a download URL. This is a supply-chain sensitive pattern before installing a binary.

High

SKILL.md:25-34

Template literal with command substitution

> ```bash

The manual install block includes command substitution that resolves a binary URL from remote manifest data. That creates risk if the manifest or parsing output is compromised.

High

SKILL.md:33

Hidden file in home directory

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The install instructions move a downloaded executable into ~/.local/bin. That creates persistent executable state in the user home path and needs strong verification.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line recommends running npx to install another CLI skill. That is a real external install path with supply-chain risk, even though the backtick subtype is imprecise.

Medium

SKILL.md:17-20

Ruby/shell backtick execution

```bash

The fenced block contains install and login shell commands, including the remote installer captured separately. It is intended command execution guidance for the agent workflow.

Medium

SKILL.md:25-34

Ruby/shell backtick execution

> ```bash

The manual install block downloads binaries, verifies checksums, extracts an archive, and moves an executable into PATH. These commands are legitimate but security-sensitive.

Medium

SKILL.md:38-56

Ruby/shell backtick execution

```bash

The quick examples run cloud AI apps through the belt CLI, including web search and Twitter posting. That creates real network and account-side effects.

Medium

SKILL.md:85-86

Ruby/shell backtick execution

| Run app | `belt app run google/veo-3-1-fast --input input.json` |

The command submits an app run through the belt CLI with an input file. It can send user-provided data to a cloud app.

Medium

SKILL.md:86-87

Ruby/shell backtick execution

| Run without waiting | `belt app run <app> --input input.json --no-wait` |

The no-wait run command submits cloud work asynchronously. It can create remote tasks that continue after the immediate agent turn.

Medium

SKILL.md:103-129

Ruby/shell backtick execution

```bash

The related-skills block contains multiple npx skills add commands. Installing remote skills expands the trusted code and instruction surface.

Medium

SKILL.md:33

Hidden file access

> mv inferencesh-cli-* ~/.local/bin/inferencesh

The command writes into a hidden home-directory path as part of installing a binary. This is common, but it is still a security-sensitive filesystem change.

Low

references/authentication.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

Line 6 fetches a remote installer from cli.inference.sh as part of a shell install path. The network access is intentional, but it retrieves executable installation content.

Low

references/authentication.md:44

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

Line 44 repeats the remote installer URL for reinstallation. This is a real network dependency tied to executable installation content.

Low

references/cli-reference.md:6

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The installation command downloads from a hardcoded remote installer URL. The URL is expected, but it is part of an executable install flow.

Low

SKILL.md:18

Hardcoded URL

curl -fsSL https://cli.inference.sh | sh

The URL is used to fetch the installer that is then piped to sh. The network dependency is part of the critical installer path.

Low

SKILL.md:27

Hardcoded URL

> curl -LO https://dist.inference.sh/cli/checksums.txt

The command downloads a checksum file from a remote distribution host. That is expected for install verification but remains a security-sensitive network dependency.

Low

SKILL.md:28

Hardcoded URL

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The command fetches a remote manifest and derives a binary URL from it. The hardcoded host is part of a dynamic binary download flow.

Risk Factors

🌐 Network access (17)

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 references/running-apps.md:152 SKILL.md:9 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:27 SKILL.md:28 SKILL.md:140 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (21)

Detected Patterns

Pipe to shell pattern×4

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/qu-skills-agent-tools/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/qu-skills-agent-tools/security.svg)](https://skillstore.io/skills/qu-skills-agent-tools?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/qu-skills-agent-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/qu-skills-agent-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/qu-skills-agent-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

qu-skills. (2026). agent-tools security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/qu-skills-agent-tools/audits/4

BibTeX citation

@techreport{qu-skills-qu-skills-agent-tools-2026,
  author = {qu-skills},
  title = {agent-tools security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/qu-skills-agent-tools/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agent-tools security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "qu-skills"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/qu-skills-agent-tools/audits/4"
identifiers:
  - type: other
    value: "skillstore:qu-skills-agent-tools:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

20 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

tul-sh Recommended

tul-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 26

Updated

2026-08-21

toolshell

toolshell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 23

Updated

2026-08-21

inferen-sh

inferen-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 14

Updated

2026-08-21

tool-belt

tool-belt-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 12

Updated

2026-08-21

inferencesh

inferencesh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 11

Updated

2026-08-21

inference-sh-skills

inference-sh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

inference-sh-7

inference-sh-7-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

inf-sh

inf-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

inference-skills

inference-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-08-21

skillssh

skillssh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

inference-sh-9

inference-sh-9-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

inference-sh-3

inference-sh-3-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 8

Updated

2026-08-21

qu-skills Current

qu-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

infsh-skills

infsh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

inference-sh-6

inference-sh-6-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

inference-sh-0

inference-sh-0-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 7

Updated

2026-08-21

inference-shell

inference-shell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

inference-sh-8

inference-sh-8-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

101-skills

101-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

halt-catch-fire

halt-catch-fire-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 4

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prototype media workflows

Find and run cloud apps for images, videos, audio, and 3D assets from one CLI flow.

Compare model providers

Inspect public app schemas and run LLM, search, or generation tasks through provider-specific apps.

Track long tasks

Submit longer cloud jobs, keep task identifiers, and retrieve generated outputs when they complete.

Try These Prompts

Find an app

Use agent-tools to find inference.sh apps for image generation. Show the best options and explain when to use each one.

Prepare a run

Use agent-tools to inspect the input requirements for a video generation app and prepare a safe run plan before executing it.

Run and track a task

Use agent-tools to run a long video task without waiting, save the task identifier, and check the result later.

Build a multi-step workflow

Use agent-tools to design a workflow that searches for source material, generates media, and tracks every cloud task with explicit approvals.

Best Practices

Ask for explicit approval before installing the CLI or running remote app commands.
Confirm every local file path before upload, especially parent or home directory paths.
Use task identifiers and app schemas to keep cloud runs reproducible.

Avoid

Do not run the pipe-to-shell installer without verifying the source and checksum.
Do not upload local media, audio, or documents without user confirmation.
Do not post, follow, like, retweet, or send messages through X/Twitter without explicit consent.