{"data":{"skill":{"slug":"101-skills-ai-video-generation","name":"ai-video-generation","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/tools/video/ai-video-generation/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"41972806-470c-4798-85a2-d555b732bb5e","skill_id":"778dc490-b621-49df-a43d-bed36dcdc36b","version":5,"content_hash":"v3:d71c7417a35d5c2624161bd2fe8de8a41a362128:2133bff3a2698f0a1409994a299fd94cf658d56c17322f9a0453ad1ef3cbb531:eed05eb86acf119032e90d7d43c271bad6002415deb8e2221c1d69e7e8c358b4:736b696c6c732f3130312d736b696c6c732f61692d766964656f2d67656e65726174696f6e:ac63ad5d8e2cce2dd9ede735e00d05ea","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The Ruby backtick alerts are Markdown formatting false positives, while one remote image reference can trigger a low-risk external request. Semantic review found broad belt command authorization and undisclosed third-party processing of user media. No prompt injection or malicious intent was found.","remediation":[{"issue":"The Bash allowlist grants all belt subcommands.","severity":"medium","suggestion":"Restrict authorization to the required belt subcommands where supported, and require confirmation for login or other account-changing operations."},{"issue":"Media examples send user assets to external inference providers without a privacy warning.","severity":"medium","suggestion":"State that inputs are processed externally and require users to confirm rights, consent, sensitivity, and provider policies before submission."},{"issue":"The skill embeds an externally hosted image that may load during rendering.","severity":"low","suggestion":"Bundle the image with the skill or use a marketplace-hosted asset to avoid unintended third-party requests."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":33,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":43},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":71,"line_start":65},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":78},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":85,"line_start":83},{"file":"SKILL.md","line_end":91,"line_start":85},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":99,"line_start":95},{"file":"SKILL.md","line_end":104,"line_start":99},{"file":"SKILL.md","line_end":108,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":121,"line_start":116},{"file":"SKILL.md","line_end":125,"line_start":121},{"file":"SKILL.md","line_end":130,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":130},{"file":"SKILL.md","line_end":140,"line_start":134},{"file":"SKILL.md","line_end":144,"line_start":140},{"file":"SKILL.md","line_end":150,"line_start":144},{"file":"SKILL.md","line_end":154,"line_start":150},{"file":"SKILL.md","line_end":160,"line_start":154},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":170,"line_start":164}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":157,"line_start":157},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":249,"line_start":249},{"file":"SKILL.md","line_end":250,"line_start":250},{"file":"SKILL.md","line_end":251,"line_start":251}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Broad belt Command Authorization","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.95,"description":"The Bash allowlist permits every belt subcommand, while the documented workflow only needs login, app discovery, and app execution operations.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The frontmatter explicitly grants Bash(belt *), which is broader than the specific subcommands shown later. The excess scope is directly observable."},{"title":"External Processing of User Media","locations":[{"file":"SKILL.md","line_end":120,"line_start":108}],"confidence":0.96,"description":"Examples send portrait, audio, image, and video locations to third-party inference applications without a privacy or consent warning.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The examples pass image and audio URLs to remote app runs. The reviewed skill contains no nearby disclosure about external processing or sensitive media."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.9,"description":"![AI Video Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"This Markdown image references cloud.inference.sh and may be fetched when the document renders. That external request can disclose viewer network metadata to the host."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":253,"audit_model":"codex","audited_at":"2026-07-12T09:56:19.126+00:00","created_at":"2026-07-14T15:53:49.298145+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 Fast | `google/veo-3-1-fast` | Fast, with optional audio |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 | `google/veo-3-1` | Best quality, frame interpolation |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 | `google/veo-3` | High quality with audio |","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 Fast | `google/veo-3-fast` | Fast with audio |","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 2 | `google/veo-2` | Realistic videos |","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast, economical, with audio support |","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-T2V** | `pruna/wan-t2v` | Economical 480p/720p |","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Grok Video | `xai/grok-imagine-video` | xAI, configurable duration |","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Text/image/ref-to-video with sync audio, up to 1080p","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse T2V** | `alibaba/happyhorse-1-0-t2v` | Physically realistic, up to 15s |","category":"external_commands","line_end":49,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 | `falai/wan-2-5` | Animate any image |","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 I2V | `falai/wan-2-5-i2v` | High quality i2v |","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-I2V** | `pruna/wan-i2v` | Economical 480p/720p |","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast i2v with audio |","category":"external_commands","line_end":53,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Animate images with sync audio, up to 1080p |","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse I2V** | `alibaba/happyhorse-1-0-i2v` | Animate images, up to 1080P/15s |","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse R2V** | `alibaba/happyhorse-1-0-r2v` | Character-preserving from references |","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.5 | `bytedance/omnihuman-1-5` | Multi-character |","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.0 | `bytedance/omnihuman-1-0` | Single character |","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Fabric 1.0 | `falai/fabric-1-0` | Image talks with lipsync |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PixVerse Lipsync | `falai/pixverse-lipsync` | Realistic lipsync |","category":"external_commands","line_end":71,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HappyHorse Edit | `alibaba/happyhorse-1-0-video-edit` | Natural language video editing |","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HunyuanVideo Foley | `infsh/hunyuanvideo-foley` | Add sound effects to video |","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Topaz Upscaler | `falai/topaz-video-upscaler` | Upscale video quality |","category":"external_commands","line_end":79,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Media Merger | `infsh/media-merger` | Merge videos with transitions |","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":91,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":104,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":112,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":121,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":134,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":140,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":144,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":150,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":154,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":160,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":170,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":179,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":183,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":188,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":194,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":203,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":207,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":212,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":243,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":245,"severity":"medium","line_start":243},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Generate videos with 40+ AI models via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![AI Video Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:110:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://your-image.jpg\"","category":"network","line_end":110,"severity":"low","line_start":110},{"id":"network:SKILL.md:118:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:SKILL.md:119:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:127:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://face.jpg\",","category":"network","line_end":127,"severity":"low","line_start":127},{"id":"network:SKILL.md:128:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://audio.mp3\"","category":"network","line_end":128,"severity":"low","line_start":128},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image\": \"https://your-image.jpg\",","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:157:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"reference_image\": \"https://portrait.jpg\",","category":"network","line_end":157,"severity":"low","line_start":157},{"id":"network:SKILL.md:176:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://your-video.mp4\",","category":"network","line_end":176,"severity":"low","line_start":176},{"id":"network:SKILL.md:185:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":185,"severity":"low","line_start":185},{"id":"network:SKILL.md:186:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":186,"severity":"low","line_start":186},{"id":"network:SKILL.md:193:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"belt app run falai/topaz-video-upscaler --input '{\"video_url\": \"https://...\"}'","category":"network","line_end":193,"severity":"low","line_start":193},{"id":"network:SKILL.md:200:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://silent-video.mp4\",","category":"network","line_end":200,"severity":"low","line_start":200},{"id":"network:SKILL.md:209:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"videos\": [\"https://clip1.mp4\", \"https://clip2.mp4\"],","category":"network","line_end":209,"severity":"low","line_start":209},{"id":"network:SKILL.md:249:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":249,"severity":"low","line_start":249},{"id":"network:SKILL.md:250:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Streaming Results](https://inference.sh/docs/api/sdk/streaming) - Real-time progress updates","category":"network","line_end":250,"severity":"low","line_start":250},{"id":"network:SKILL.md:251:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Content Pipeline Example](https://inference.sh/docs/examples/content-pipeline) - Building media w","category":"network","line_end":251,"severity":"low","line_start":251}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The backticks are Markdown inline-code delimiters around an installation example. This line does not perform Ruby command substitution or automatic shell execution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks only format the belt executable name in Markdown. No command or command-substitution expression executes at this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The backticks format a model or application identifier inside a Markdown table. There is no Ruby evaluation, shell substitution, or executable statement here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The detected backticks open a fenced Bash example in Markdown. They are documentation delimiters, not Ruby backtick execution or shell command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The detected backticks close a Markdown code fence. A closing fence is inert text and does not execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:11:hardcoded-url","reason":"This is a documentation hyperlink in Markdown. The skill does not automatically request the URL, and the link targets the named service or its documentation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"This Markdown image references cloud.inference.sh and may be fetched when the document renders. That external request can disclose viewer network metadata to the host.","verdict":"confirmed","severity":"low","confidence":0.9},{"id":"network:SKILL.md:17:hardcoded-url","reason":"This is a documentation hyperlink in Markdown. The skill does not automatically request the URL, and the link targets the named service or its documentation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:110:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:118:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:119:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:127:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:128:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:146:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:157:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:176:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:185:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:186:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:193:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:200:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:209:hardcoded-url","reason":"The URL is a clearly synthetic placeholder inside a documented input example. It is not a live destination or an automatic request embedded in executable code.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:249:hardcoded-url","reason":"This is a documentation hyperlink in Markdown. The skill does not automatically request the URL, and the link targets the named service or its documentation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:250:hardcoded-url","reason":"This is a documentation hyperlink in Markdown. The skill does not automatically request the URL, and the link targets the named service or its documentation.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:251:hardcoded-url","reason":"This is a documentation hyperlink in Markdown. The skill does not automatically request the URL, and the link targets the named service or its documentation.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Broad belt Command Authorization","severity":"medium","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.95,"description":"The Bash allowlist permits every belt subcommand, while the documented workflow only needs login, app discovery, and app execution operations.","confidence_reasoning":"The frontmatter explicitly grants Bash(belt *), which is broader than the specific subcommands shown later. The excess scope is directly observable."},{"title":"External Processing of User Media","severity":"medium","locations":[{"file":"SKILL.md","line_end":120,"line_start":108}],"confidence":0.96,"description":"Examples send portrait, audio, image, and video locations to third-party inference applications without a privacy or consent warning.","confidence_reasoning":"The examples pass image and audio URLs to remote app runs. The reviewed skill contains no nearby disclosure about external processing or sensitive media."}],"subject_marketplace_commit_sha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","subject_content_hash":"2133bff3a2698f0a1409994a299fd94cf658d56c17322f9a0453ad1ef3cbb531","subject_tree_hash":"eed05eb86acf119032e90d7d43c271bad6002415deb8e2221c1d69e7e8c358b4","subject_plugin_path":"skills/101-skills/ai-video-generation","audit_payload_hash":"ac63ad5d8e2cce2dd9ede735e00d05ea","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","contentHash":"2133bff3a2698f0a1409994a299fd94cf658d56c17322f9a0453ad1ef3cbb531","treeHash":"eed05eb86acf119032e90d7d43c271bad6002415deb8e2221c1d69e7e8c358b4","pluginPath":"skills/101-skills/ai-video-generation","auditPayloadHash":"ac63ad5d8e2cce2dd9ede735e00d05ea"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}