{"data":{"skill":{"slug":"101-skills-app-store-screenshots","name":"app-store-screenshots","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/guides/design/app-store-screenshots/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"0078bf39-8940-4d0d-8ce7-c28a4c764f3e","skill_id":"f3a3bb28-5bb8-48b6-8069-63ed717a7e0a","version":3,"content_hash":"v3:d71c7417a35d5c2624161bd2fe8de8a41a362128:3fd7a868ffdf84122a84934d4a190fbc53d0f42ed47d20b5038461d24b7142c8:e82706d8f2f8a8eea01578d3eaf8930a5b1e147104d4f63f4c8c7ce9d68f0e23:736b696c6c732f3130312d736b696c6c732f6170702d73746f72652d73637265656e73686f7473:456d56a07e7f1ffd1729b3abbfbaa3bc","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The guide intentionally recommends external CLI installation and remote inference commands, creating supply-chain and third-party processing risks. Most detections are Markdown fences or prose references without execution behavior.","remediation":[{"issue":"The guide recommends installing skills and running an external CLI.","severity":"medium","suggestion":"Pin package versions, document trusted sources, and require user confirmation before installation or command execution."},{"issue":"Prompts and source images may be processed by an external inference service.","severity":"medium","suggestion":"Disclose external processing and instruct users to remove secrets, personal data, and confidential interface content before submission."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":26,"line_start":17},{"file":"SKILL.md","line_end":83,"line_start":26},{"file":"SKILL.md","line_end":97,"line_start":83},{"file":"SKILL.md","line_end":121,"line_start":97},{"file":"SKILL.md","line_end":131,"line_start":121},{"file":"SKILL.md","line_end":137,"line_start":131},{"file":"SKILL.md","line_end":144,"line_start":137},{"file":"SKILL.md","line_end":148,"line_start":144},{"file":"SKILL.md","line_end":154,"line_start":148},{"file":"SKILL.md","line_end":158,"line_start":154},{"file":"SKILL.md","line_end":165,"line_start":158},{"file":"SKILL.md","line_end":169,"line_start":165},{"file":"SKILL.md","line_end":175,"line_start":169},{"file":"SKILL.md","line_end":206,"line_start":175},{"file":"SKILL.md","line_end":211,"line_start":206},{"file":"SKILL.md","line_end":262,"line_start":211},{"file":"SKILL.md","line_end":267,"line_start":262},{"file":"SKILL.md","line_end":269,"line_start":267}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":15,"line_start":15}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.96,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 7 explicitly instructs users to execute npx against a third-party package source. This creates external command and package supply-chain exposure."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":17}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited block contains belt login and belt app run commands. These invoke an installed external CLI and submit an inference job."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":144,"line_start":137}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited Bash block runs belt app run against a remote image model. It is an intentional external command."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":154,"line_start":148}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited Bash block invokes belt app run for external image generation. This is real external CLI execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":165,"line_start":158}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The Bash block runs an external belt inference command. Execution is expected and clearly disclosed."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":175,"line_start":169}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The cited Bash example runs belt with local image filenames as inference inputs. This is intentional external command execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":211,"line_start":206}],"confidence":0.98,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The Bash block invokes belt app run for remote video generation. This is a genuine external process and service call."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":267,"line_start":262}],"confidence":0.97,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The Bash block contains four npx skills add commands for third-party skills. Running them introduces package installation and supply-chain exposure."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":269,"line_start":267}],"confidence":0.9,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Although line 267 is a closing fence, the cited range also tells users to run belt app store. This is an explicit external CLI command."},{"title":"External Processing Without Privacy Guidance","locations":[{"file":"SKILL.md","line_end":15,"line_start":11},{"file":"SKILL.md","line_end":175,"line_start":169}],"confidence":0.86,"description":"The workflow sends prompts and potentially local app screenshots to external inference models without warning users to remove sensitive or confidential content.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The guide names an external inference service and supplies local image filenames to a remote app command. No privacy or data-handling warning appears."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":11,"line_start":11}],"confidence":0.88,"description":"Create app store screenshots and preview videos via [inference.sh](https://inference.sh) CLI.","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The text states that generation occurs through inference.sh, and later commands submit jobs to that service. External processing is an intended network dependency."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":271,"audit_model":"codex","audited_at":"2026-07-12T09:59:57.918+00:00","created_at":"2026-07-14T15:53:49.313746+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":83,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":97,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":121,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":131,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":144,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":148,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":154,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":158,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":165,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":169,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":175,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":206,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":211,"severity":"medium","line_start":206},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":262,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":267,"severity":"medium","line_start":262},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":269,"severity":"medium","line_start":267},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Create app store screenshots and preview videos via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: \"App Store and Google Play screenshot creation with exact platform specs. Covers iOS/An","category":"blocker","line_end":3,"severity":"low","line_start":3}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Line 7 explicitly instructs users to execute npx against a third-party package source. This creates external command and package supply-chain exposure.","verdict":"confirmed","severity":"medium","confidence":0.96},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The backticks only format the CLI name in prose. No command is executed at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The cited block contains belt login and belt app run commands. These invoke an installed external CLI and submit an inference job.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 is a Markdown fence delimiter followed by explanatory platform guidance. It is not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This fenced block is a visual ASCII layout for a screenshot. It contains no executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"Line 97 closes a visual example, and the following text is design guidance. No shell command appears in the cited range.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The fenced content contains caption-writing examples only. It does not invoke a shell or interpreter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"Line 131 is a closing Markdown fence, followed by headings and prose. The delimiter is not command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The cited Bash block runs belt app run against a remote image model. It is an intentional external command.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"Line 144 only closes a Bash example. The following lines are a heading and another opening fence.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"The cited Bash block invokes belt app run for external image generation. This is real external CLI execution.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"Line 154 is a Markdown fence delimiter. The cited transition contains no executable statement.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The Bash block runs an external belt inference command. Execution is expected and clearly disclosed.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Line 165 closes a code block and is followed by a heading. It does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The cited Bash example runs belt with local image filenames as inference inputs. This is intentional external command execution.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"Line 175 closes the preceding command example, while the remaining range contains specifications and prose. The fence itself is inert.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:206:ruby-shell-backtick-execution","reason":"The Bash block invokes belt app run for remote video generation. This is a genuine external process and service call.","verdict":"confirmed","severity":"medium","confidence":0.98},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"Line 211 is a closing fence, followed by localization, testing, and checklist prose. No command exists in this cited range.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:262:ruby-shell-backtick-execution","reason":"The Bash block contains four npx skills add commands for third-party skills. Running them introduces package installation and supply-chain exposure.","verdict":"confirmed","severity":"medium","confidence":0.97},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"Although line 267 is a closing fence, the cited range also tells users to run belt app store. This is an explicit external CLI command.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"network:SKILL.md:11:hardcoded-url","reason":"The text states that generation occurs through inference.sh, and later commands submit jobs to that service. External processing is an intended network dependency.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"network:SKILL.md:15:hardcoded-url","reason":"This is a visible HTTPS link to installation documentation on GitHub. The skill does not automatically fetch or execute the linked content.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"The line is frontmatter describing mobile screenshot dimensions, mockups, and store listings. It contains no system discovery or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"External Processing Without Privacy Guidance","severity":"medium","locations":[{"file":"SKILL.md","line_end":15,"line_start":11},{"file":"SKILL.md","line_end":175,"line_start":169}],"confidence":0.86,"description":"The workflow sends prompts and potentially local app screenshots to external inference models without warning users to remove sensitive or confidential content.","confidence_reasoning":"The guide names an external inference service and supplies local image filenames to a remote app command. No privacy or data-handling warning appears."}],"subject_marketplace_commit_sha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","subject_content_hash":"3fd7a868ffdf84122a84934d4a190fbc53d0f42ed47d20b5038461d24b7142c8","subject_tree_hash":"e82706d8f2f8a8eea01578d3eaf8930a5b1e147104d4f63f4c8c7ce9d68f0e23","subject_plugin_path":"skills/101-skills/app-store-screenshots","audit_payload_hash":"456d56a07e7f1ffd1729b3abbfbaa3bc","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"d71c7417a35d5c2624161bd2fe8de8a41a362128","contentHash":"3fd7a868ffdf84122a84934d4a190fbc53d0f42ed47d20b5038461d24b7142c8","treeHash":"e82706d8f2f8a8eea01578d3eaf8930a5b1e147104d4f63f4c8c7ce9d68f0e23","pluginPath":"skills/101-skills/app-store-screenshots","auditPayloadHash":"456d56a07e7f1ffd1729b3abbfbaa3bc"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":10,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}