{"id":"cmsgmwmud004mad07n3t1wl6g","slug":"building-inferencesh-apps","publicId":"b587cc17-1c45-49bf-9f74-62ca7e14a6d4","name":"building-inferencesh-apps","description":"Build and deploy applications on inference.sh. Use when getting started, understanding the platform, creating apps, configuring resources, or needing an overview of inference.sh app development. Supports both Python and Node.js. Triggers: inference.sh app, belt app, inf.yml, inference.py, inference.js, deploy app, app development, build app, create app, GPU app, VRAM, app resources, app secrets, app integrations, multi-function app","version":"","author":"101-skills","license":"","compatibility":"","status":"completed","overallGrade":"C","scannerVersion":9,"fileCount":10,"hasSkillMd":true,"hasScripts":false,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/101-skills/skills/tree/main/sdk/building-apps","createdAt":"2026-08-05T22:04:08.484Z","completedAt":"2026-08-05T22:04:08.480Z","visibility":"public","publishedAt":"2026-08-05T22:04:08.479Z","category":"","frameworks":[],"badgeStatus":"conditional","downloadCount":0,"verdictRationale":{"summary":"Skill has warnings: 1 warning in security or structure checks.","verdict":"warn","scanners":[{"source":"vettd","weight":1,"verdict":"warn"},{"source":"cisco","weight":0.8,"verdict":"warn"}],"consensus":"warn","warnTriggers":["References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":[]},"verdictPolicyVersion":"consensus-v1","skillId":"cmsgmwmty004kad07vlkla6kt","findings":[{"id":"cmsgmwmue0054ad07xtkizsv4","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"SKILL.md:1 — Pipeline downloads data from the network and executes it: `curl -fsSL https://cli.inference.sh | sh`. This is a remote code execution pattern.","severity":"high","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"bab54f18dbd3a54ded23530f3cbd9490","filepath":"SKILL.md"},{"id":"cmsgmwmud0052ad07m3d7uoqd","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42638a8b7e9fc5df27449992eaebc724","filepath":"SKILL.md"},{"id":"cmsgmwmue0055ad07jqkzh94l","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/cli.md:1 — Pipeline downloads data from the network and executes it: `curl -fsSL https://cli.inference.sh | sh`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7ab89a8b589857fecd2817ceeb1acd16","filepath":"references/cli.md"},{"id":"cmsgmwmue0057ad07ef8cd8on","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/cli.md:2 — Pipeline downloads data from the network and executes it: `curl -fsSL https://fnm.vercel.app/install | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7ab89a8b589857fecd2817ceeb1acd16","filepath":"references/cli.md"},{"id":"cmsgmwmue0056ad07cemqdzos","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/cli.md:2 — Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7ab89a8b589857fecd2817ceeb1acd16","filepath":"references/cli.md"},{"id":"cmsgmwmue0058ad07l47w1rcx","source":"cisco","category":"security","label":"Dangerous data flow in command pipeline","detail":"references/cli.md:6 — Pipeline downloads data from the network and executes it: `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)","severity":"low","ruleId":"PIPELINE_TAINT_FLOW","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7ab89a8b589857fecd2817ceeb1acd16","filepath":"references/cli.md"},{"id":"cmsgmwmud0051ad077kpdmeb6","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cmsgmwmud004sad074dc8xgzr","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cmsgmwmud0050ad07i392uwke","source":"vettd","category":"security","label":"No secrets or unsafe code patterns detected","detail":"Scanned all files for credentials, private keys, and code-level risks (eval, shell exec, destructive ops)","severity":"info","ruleId":"VTD-0091","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2e3428ecd3c04cac33cabd959f51437a","filepath":""},{"id":"cmsgmwmud0053ad07b6c9b3z7","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"},{"id":"cmsgmwmud004oad074bcomt1b","source":"vettd","category":"structure","label":"No scripts/ directory","detail":"Consider bundling reusable scripts for validation and automation","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cmsgmwmud004pad07yk3r2wx3","source":"vettd","category":"structure","label":"references/ directory present","detail":"Additional documentation files available for progressive disclosure","severity":"info","ruleId":"VTD-0097","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a5f22b7185c58877c3d5a94338930d62","filepath":""},{"id":"cmsgmwmud004nad07rfefncy4","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cmsgmwmud004rad07wvak7c12","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"building-inferencesh-apps\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cmsgmwmud004uad07zvjhh7vy","source":"vettd","category":"description","label":"Description includes usage context","detail":"Good: description explains when to activate the skill","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cmsgmwmud004tad07yyesd0yv","source":"vettd","category":"description","label":"Description within character limit","detail":"435/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cmsgmwmud004wad07hz1seolp","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cmsgmwmud004zad07i7f4mfee","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cmsgmwmud004vad07ipmict0r","source":"vettd","category":"best-practices","label":"SKILL.md body length is reasonable","detail":"394 lines (recommended: under 500)","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cmsgmwmud004xad07y4llufv8","source":"vettd","category":"best-practices","label":"Step-by-step workflow found","detail":"Structured procedures improve reliability for complex tasks","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cmsgmwmud004yad071n70xbdm","source":"vettd","category":"best-practices","label":"Validation loop referenced","detail":"Instructions for the agent to validate its own work before proceeding","severity":"info","ruleId":"VTD-0105","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e5a31b775d1df438cbeb1e3fcb2ff503","filepath":""},{"id":"cmsgmwmud004qad07unvdjdyi","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"C","findingCount":6,"criticalCount":0,"highCount":1},{"source":"vettd","status":"success","verdict":null,"grade":"B","findingCount":16,"criticalCount":0,"highCount":0}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":{"owner":"101-skills","name":"skills"},"freshness":{"status":"unreachable","reason":"renamed","retryable":false,"renamedTo":"inference-sh/skills","lastCheckedAt":"2026-10-21T11:07:39.317Z","lastVerifiedAt":null,"lastChangeDetectedAt":null,"scannedHash":"becc25649700d5457772a00e5143e28ccf9e5afa","latestUpstreamHash":null,"nextCheckDueAt":"2026-10-28T11:07:39.317Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":22,"publisherSupplied":["name","description","author","version","license"]}