Skills agent-tools

📦

agent-tools

Name: agent-tools
Author: skillssh

Content revision r2 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands

Run AI Apps with the inference.sh CLI

Running many hosted AI models often requires separate commands and input formats. This skill organizes discovery, authentication, file uploads, task tracking, and app execution through one CLI workflow.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "agent-tools" from https://skillstore.io/skills/skillssh-agent-tools.md and its manifest at https://skillstore.io/api/skills/skillssh-agent-tools/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/skillssh-agent-tools.md Signed manifest GET /api/skills/skillssh-agent-tools/manifest Signed lockfile GET /api/skills/skillssh-agent-tools/lockfile

Test it

Using "agent-tools". I need to turn a local product image into a short video.

Expected outcome:

A workflow that selects an image-to-video app, passes the local image path, submits the job, and checks the task result.

Using "agent-tools". How can I find a hosted model for technical research?

Expected outcome:

A discovery workflow that searches the app store, filters by category, inspects app details, and compares input requirements.

Using "agent-tools". I need a repeatable image generation test.

Expected outcome:

Choose a specific app version.
Create a sample input and edit the prompt.
Run the task and record the returned result.

Security Audit

Critical

v5 • 9/7/2026 Open versioned report

The skill is primarily operational documentation for a hosted AI CLI, and most findings are safe documentation patterns. The installer pipes a remote script to a shell, reads API credentials, and uses remote manifest data in command substitution, so those findings remain confirmed; social-media posting also creates a separate business-logic risk.

Files scanned

599

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

Critical

references/authentication.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.

Critical

references/authentication.md:44

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.

Critical

references/cli-reference.md:6

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.

Critical

SKILL.md:18

Pipe to shell pattern

curl -fsSL https://cli.inference.sh | sh

The command downloads a remote installer and executes it immediately through a shell. This creates a supply-chain and arbitrary-code-execution risk if the endpoint or connection is compromised.

High

SKILL.md:51-52

High-Impact Social-Media Automation

The skill demonstrates posting to Twitter through a hosted app. A mistaken prompt or compromised app could publish content using the user's account without an approval step.

The file explicitly shows a command that posts a supplied message to Twitter. This is a direct external side effect and a business-logic risk beyond generic command execution.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:30

Generic API/secret keys

export INFSH_API_KEY=your-api-key

The documentation instructs users to place an API key in an environment variable. This is a legitimate authentication mechanism, but mishandling the variable can expose a credential, so the security risk is confirmed.

High

references/authentication.md:53

Generic API/secret keys

| "API key invalid" | Check `INFSH_API_KEY` or re-login |

High

references/cli-reference.md:79

Generic API/secret keys

| `INFSH_API_KEY` | API key (overrides config) |

High

SKILL.md:28

Shell command substitution

> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep

The manual install command parses a remote manifest inside command substitution and uses the result in a download command. This creates a supply-chain risk because remote metadata influences the artifact URL.

Risk Factors

🌐 Network access (17)

references/authentication.md:6 references/authentication.md:44 references/cli-reference.md:6 references/running-apps.md:152 SKILL.md:9 SKILL.md:13 SKILL.md:18 SKILL.md:22 SKILL.md:27 SKILL.md:28 SKILL.md:140 SKILL.md:141 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146

🔑 Env variables (3)

references/authentication.md:30 references/authentication.md:53 references/cli-reference.md:79

📁 Filesystem access (5)

references/cli-reference.md:91 references/cli-reference.md:91 references/running-apps.md:41 SKILL.md:33 SKILL.md:33

⚙️ External commands (21)

Detected Patterns

Pipe to shell pattern×4

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/skillssh-agent-tools/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/skillssh-agent-tools/security.svg)](https://skillstore.io/skills/skillssh-agent-tools?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/skillssh-agent-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skillssh-agent-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/skillssh-agent-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

skillssh. (2026). agent-tools security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skillssh-agent-tools/audits/5

BibTeX citation

@techreport{skillssh-skillssh-agent-tools-2026,
  author = {skillssh},
  title = {agent-tools security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/skillssh-agent-tools/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agent-tools security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "skillssh"
date-released: "2026-09-07"
url: "https://skillstore.io/skills/skillssh-agent-tools/audits/5"
identifiers:
  - type: other
    value: "skillstore:skillssh-agent-tools:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

20 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

tul-sh Recommended

tul-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 60

Updated

2026-09-09

toolshell

toolshell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 57

Updated

2026-09-09

inferen-sh

inferen-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 48

Updated

2026-09-09

tool-belt

tool-belt-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 47

Updated

2026-09-09

inferencesh

inferencesh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 45

Updated

2026-09-09

inference-sh-7

inference-sh-7-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 44

Updated

2026-09-09

inference-skills

inference-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 43

Updated

2026-09-09

inference-sh-9

inference-sh-9-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 43

Updated

2026-09-09

qu-skills

qu-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 42

Updated

2026-09-09

infsh-skills

infsh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 42

Updated

2026-09-09

inf-sh

inf-sh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 42

Updated

2026-09-09

inference-sh-skills

inference-sh-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 42

Updated

2026-09-09

inference-shell

inference-shell-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 42

Updated

2026-09-09

inference-sh-6

inference-sh-6-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 41

Updated

2026-09-09

inference-sh-3

inference-sh-3-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 41

Updated

2026-09-09

inference-sh-0

inference-sh-0-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 39

Updated

2026-09-09

inference-sh-8

inference-sh-8-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 38

Updated

2026-09-09

101-skills

101-skills-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 38

Updated

2026-09-09

halt-catch-fire

halt-catch-fire-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 37

Updated

2026-09-09

skillssh Current

skillssh-agent-tools

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 9

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prototype media workflows

Find image, video, audio, or 3D apps and run them with structured inputs.

Connect hosted models to projects

Use CLI commands, input files, and task tracking to test hosted models in development workflows.

Automate research tasks

Run hosted language models and search apps for repeatable research and content workflows.

Try These Prompts

Run a first app

Show me how to authenticate the inference.sh CLI and run one image-generation app with a simple prompt.

Discover the right app

Help me search the app store for a hosted video model, inspect its input schema, and choose a suitable app.

Process a local file

Create a command workflow that sends a local image to an upscaling app, saves the result, and checks the task status.

Design a reliable pipeline

Design a version-pinned inference.sh workflow for a production prototype with input validation, asynchronous tasks, retries, secret handling, and output tracking.

Best Practices

Inspect an app schema and generate a sample input before running it.
Pin app versions for repeatable tests and review hosted-app permissions.
Keep API keys in a protected secret manager and confirm external side effects.

Avoid

Do not pipe an unreviewed remote installer directly into a shell.
Do not upload sensitive local files to hosted apps without approval.
Do not automate social-media actions without previews, limits, and confirmation.

Frequently Asked Questions

What does this skill control?

It explains inference.sh CLI workflows. The hosted platform performs the actual model execution.

Do I need an account?

Yes. You need a valid inference.sh account and authentication before running hosted apps.

Can I use local files?

Yes. The documented CLI workflow accepts local paths for fields that support file or URL inputs.

Can I run long jobs asynchronously?

Yes. Submit a job without waiting, then use its task identifier to check status and retrieve results.

Does it support Claude?

The documentation includes Claude through a hosted OpenRouter application, subject to current platform availability.

Is it suitable for production automation?

It provides workflow guidance, but production use requires secret management, version pinning, validation, limits, and failure handling.

Developer Details

Author

skillssh

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/skillssh/skills/tree/main/tools/agent-tools/

Ref

b1ef80115e869b66867d4eac8e3c8dc56a393a8d

Maintenance freshness

9/9/2026

Usage

8 downloads · 96 views

File structure

📁 references/

📄 app-discovery.md

📄 authentication.md

📄 cli-reference.md

📄 running-apps.md

📄 SKILL.md

More from skillssh

View all

📦

remotion-render

Render React Animations as MP4 Videos

Teams need reliable videos from React animation code without manual export work. This skill sends Remotion TSX to inference.sh and returns an MP4 render.

Design & Creative View

📦

web-search

Search and Extract Web Sources

Research tasks need current sources and clean page text. This skill routes search, answers, and extraction through Tavily and Exa apps.

Research & Learning View

📦

ai-video-generation

Create AI Videos with Multiple Models

Choosing and invoking video models can be complex. This skill provides model guidance and belt CLI examples for generation, animation, editing, lipsync, sound, and upscaling.

Design & Creative View

📦

twitter-automation

Automate Twitter/X Posts and Engagement

Manual Twitter/X posting and engagement can slow campaign work. This skill uses inference.sh CLI apps to run approved posting, media, and engagement tasks.

Communication View

📦

python-executor

Run Python Code in a Sandbox

Agents often need Python execution without managing local packages. This skill runs scripts through inference.sh with common data, web, media, and document libraries.

Coding & Development View

📦

infsh-cli

Run AI Apps with the inference.sh CLI

Teams need one interface for many hosted AI models and media tools. This skill helps agents discover, run, and monitor inference.sh apps from the CLI.

DevOps & Infrastructure View

View all

📦

inference-sh

Run AI Apps with inference.sh

by inference-sh

AI model workflows often require separate APIs, credentials, and task tracking. This skill helps Claude, Codex, and Claude Code use inference.sh CLI workflows.

DevOps & Infrastructure View

📦

lark-base

Manage Lark Base Data and Automations

by larksuite

Managing Lark Base structures and data requires precise commands and schemas. This skill guides reliable CLI operations for tables, records, views, forms, dashboards, workflows, and roles.

Office & Reports View

📦

miro-automation

Automate Miro Board Workflows

by sickn33

Manual board setup and maintenance consume collaboration time. This skill uses Rube MCP to find, create, organize, connect, and share Miro content.

Productivity View

📦

javascript-sdk

Build JavaScript AI Apps with inference.sh

by inference-sh-9

JavaScript teams need clear patterns for calling inference.sh from apps and services. This skill provides SDK setup, app execution, streaming, file, agent, and proxy guidance.

Coding & Development View

📦

paperclip-create-agent

Create Governed Paperclip Agent Hires

by getpaperclipai

Creating a new agent requires consistent configuration, a clear role charter, and the correct approval process. This skill guides Paperclip users through discovery, drafting, review, submission, and approval follow-up.

Productivity View

📦

appinsights-instrumentation

Instrument Apps with Azure Application Insights

by microsoft

Application teams need consistent telemetry setup across languages and Azure hosting services. This skill provides targeted SDK, infrastructure, environment, and query guidance for Application Insights.

DevOps & Infrastructure View

agent-tools

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (5)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Compare variants

Skillstore Score

What You Can Build

Prototype media workflows

Connect hosted models to projects

Automate research tasks

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from skillssh

remotion-render

web-search

ai-video-generation

twitter-automation

python-executor

infsh-cli

Related Skills

inference-sh

lark-base

miro-automation

javascript-sdk

paperclip-create-agent

appinsights-instrumentation