Agent skill · Audited from source
infsh-cli
skill · magentosh/skillsLicence not declaredAudited 29 Oct 2026 · source 4599ef28a2a7
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 4599ef28a2a7 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Run AI apps via inference.sh CLI - image generation, video creation, LLMs, search, 3D, Twitter automation. Models: FLUX, Veo, Gemini, Grok, Claude, Seedance, OmniHuman, Tavily, Exa, OpenRouter, and many more. Use when…
Cite
Cite this page
ModelsAtlas. “infsh-cli (magentosh/skills)”. Retrieved 29 Oct 2026. https://modelsatlas.com/skills/magentosh/infsh-cli
6 skills are called “infsh-cli”. You are viewing magentosh/skills.
- magentosh/skills★ 789✓SAFE
- 101-skills/skills★ 789!CAUTION
- halt-catch-fire/skills★ 789✓SAFE
- qu-skills/skills★ 789✓SAFE
- skills-shell/skills★ 789✓SAFE
and 1 more with this name.
Trust audit
Audit 0.4.1 · source read 29 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 6 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (7)
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
INFOPrompt injectionprompt.authority_framing · SKILL.md:25
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and architecture, downloads the correct binary from `dist.inference.sh`, verifies its SHA-256 checksum,
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.persistence · references/authentication.md:62
| "command not found" | Reinstall CLI or add to PATH |
- Why
- instructs the agent to persist itself in the user's environment
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · SKILL.md:18
curl -fsSL https://cli.inference.sh | sh
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · references/authentication.md:6
curl -fsSL https://cli.inference.sh | sh
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · references/authentication.md:54
curl -fsSL https://cli.inference.sh | sh
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOSupply chainprompt.pipe_to_shell · references/cli-reference.md:6
curl -fsSL https://cli.inference.sh | sh
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 4599ef28a2a7 · 29 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishermagentosh GitHub organizationOwner of the repository this skill is read from
- Source foldermagentosh/skills/tools/infsh-cliThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict4599ef28a2a7A new audit runs when the source changes
- Repository statusNot archivedLast push 13 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Run AI apps via inference.sh CLI - image generation, video creation, LLMs, search, 3D, Twitter automation. Models: FLUX, Veo, Gemini, Grok, Claude, Seedance, OmniHuman, Tavily, Exa, OpenRouter, and many more. Use when…
---
name: infsh-cli
description: "Run AI apps via inference.sh CLI - image generation, video creation, LLMs, search, 3D, Twitter automation. Models: FLUX, Veo, Gemini, Grok, Claude, Seedance, OmniHuman, Tavily, Exa, OpenRouter, and many more. Use when running AI apps, generating images/videos, calling LLMs, web search, or automating Twitter. Triggers: inference.sh, infsh, ai model, run ai, serverless ai, ai api, flux, veo, claude api, image generation, video generation, openrouter, tavily, exa search, twitter api, grok"
allowed-tools: Bash(belt *)
---
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
# [inference.sh](https://inference.sh)
Run AI apps in the cloud with a simple CLI. No GPU required.
](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgjw8atdxgkrsr8a2t5peq7b.jpeg)
## Install CLI
```bash
curl -fsSL https://cli.inference.sh | sh
belt login
```
Agents / non-interactive shells: `printf %s "$KEY" | belt login --key-stdin`, or set `INFERENCE_API_KEY` (read on every command, no login needed; older belt versions read `INFSH_API_KEY`, now deprecated).
Without a TTY, `belt login` prints a URL; the browser then shows a claim code. Run `belt login --code <code>` on the same machine within 5 minutes.
> **What does the installer do?** The [install script](https://cli.inference.sh) detects your OS and architecture, downloads the correct binary from `dist.inference.sh`, verifies its SHA-256 checksum, and places it in your PATH. That's it — no elevated permissions, no background processes, no telemetry. If you have [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) installed, the installer also verifies the Sigstore signature automatically.
>
> **Manual install** (if you prefer not to pipe to sh):
> ```bash
> # Download the binary and checksums
> curl -LO https://dist.inference.sh/cli/checksums.txt
> curl -LO $(curl -fsSL https://dist.inference.sh/cli/manifest.json | grep -o '"url":"[^"]*"' | grep $(uname -s | tr A-Z a-z)-$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') | head -1 | cut -d'"' -f4)
> # Verify checksum
> sha256sum -c checksums.txt --ignore-missing
> # Extract and install
> tar -xzf inferencesh-cli-*.tar.gz
> mv inferencesh-cli-* ~/.local/bin/inferencesh
> ```
## Quick Examples
```bash
# Generate an image
belt app run falai/flux-dev-lora --input '{"prompt": "a cat astronaut"}'
# Generate a video
belt app run google/veo-3-1-fast --input '{"prompt": "drone over mountains"}'
# Call Claude
belt app run openrouter/claude-sonnet-45 --input '{"prompt": "Explain quantum computing"}'
# Web search
belt app run tavily/search-assistant --input '{"query": "latest AI news"}'
# Post to Twitter
belt app run x/post-create --input '{"text": "Hello from AI!"}'
# Generate 3D model
belt app run infsh/rodin-3d-generator --input '{"prompt": "a wooden chair"}'
```
## Local File Uploads
The CLI automatically uploads local files when you provide a path instead of a URL:
```bash
# Upscale a local image
belt app run falai/topaz-image-upscaler --input '{"image": "/path/to/photo.jpg", "upscale_factor": 2}'
# Image-to-video from local file
belt app run falai/wan-2-5-i2v --input '{"image": "./my-image.png", "prompt": "make it move"}'
# Avatar with local audio and image
belt app run bytedance/omnihuman-1-5 --input '{"audio": "/path/to/speech.mp3", "image": "/path/to/face.jpg"}'
# Post tweet with local media
belt app run x/post-create --input '{"text": "Check this out!", "media": ["./screenshot.png"]}'
```
## Commands
| Task | Command |
|------|---------|
| Browse the app store | `belt app list` |
| Search the store | `belt app search "flux"` |
| Filter by category | `belt app list --category image` |
| List your apps | `belt app list` |
| Get app details | `belt app get google/veo-3-1-fast` |
| Generate sample input | `belt app sample google/veo-3-1-fast --save input.json` |
| Run app | `belt app run google/veo-3-1-fast --input input.json` |
| Run without waiting | `belt app run <app> --input input.json --no-wait` |
| Check task status | `belt task get <task-id>` |
## What's Available
| Category | Examples |
|----------|----------|
| **Image** | FLUX, Gemini 3 Pro, Grok Imagine, Seedream 4.5, Reve, Topaz Upscaler |
| **Video** | Veo 3.1, Seedance 2.0, Wan 2.5, OmniHuman, Fabric, MMAudio |
| **LLMs** | Claude Opus/Sonnet/Haiku, Gemini 3 Pro, Kimi K2, GLM-4, any OpenRouter model |
| **Search** | Tavily Search, Tavily Extract, Exa Search, Exa Answer, Exa Extract |
| **3D** | Rodin 3D Generator |
| **Twitter/X** | post-create, dm-send, user-follow, post-like, post-retweet |
| **Utilities** | Media merger, caption videos, image stitching, audio extraction |
## Related Skills
```bash
# Image generation (FLUX, Gemini, Grok, Seedream)
npx skills add inference-sh/skills@ai-image-generation
# Video generation (Veo, Seedance, Wan, OmniHuman)
npx skills add inference-sh/skills@ai-video-generation
# LLMs (Claude, Gemini, Kimi, GLM via OpenRouter)
npx skills add inference-sh/skills@llm-models
# Web search (Tavily, Exa)
npx skills add inference-sh/skills@web-search
# AI avatars & lipsync (OmniHuman, Fabric, PixVerse)
npx skills add inference-sh/skills@ai-avatar-video
# Twitter/X automation
npx skills add inference-sh/skills@twitter-automation
# Model-specific
npx skills add inference-sh/skills@flux-image
npx skills add inference-sh/skills@google-veo
# Utilities
npx skills add inference-sh/skills@image-upscaling
npx skills add inference-sh/skills@background-removal
```
## Reference Files
- [Authentication & Setup](references/authentication.md)
- [Discovering Apps](references/app-discovery.md)
- [Running Apps](references/running-apps.md)
- [CLI Reference](references/cli-reference.md)
## Documentation
- [Agent Skills Overview](https://inference.sh/blog/skills/skills-overview) - The open standard for AI capabilities
- [Getting Started](https://inference.sh/docs/getting-started/introduction) - IntroExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 4599ef2
npx skills add inference-sh/skills@ai-image-generation npx skills add inference-sh/skills@ai-video-generation npx skills add inference-sh/skills@llm-models npx skills add inference-sh/skills@web-search npx skills add inference-sh/skills@ai-avatar-video npx skills add inference-sh/skills@twitter-automation
git clone https://github.com/magentosh/skills git -C skills checkout 4599ef28a2a7
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 4599ef28a2a7 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
4599ef28a2a7
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/magentosh/infsh-cli/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/magentosh/infsh-cli/)
<a href="https://modelsatlas.com/skills/magentosh/infsh-cli/"><img src="https://modelsatlas.com/skills/magentosh/infsh-cli/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about infsh-cli
What does the infsh-cli skill do?
Is infsh-cli safe to install?
What can infsh-cli access on my machine?
How current is this page?
Sources
- github.com/magentosh/skills/tree/main/tools/infsh-cli — the audited source at commit 4599ef28a2a7 and every finding aboveObserved · 29 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the infsh-cli skill do?
- Is infsh-cli safe to install?
- What can infsh-cli access on my machine?