{"data":{"skill":{"slug":"101-skills-python-executor","name":"python-executor","icon":"📦","repo":"https://github.com/101-skills/skills/tree/main/tools/utilities/python-executor/","status":"approved","author":"101-skills","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"bb7443a5-4992-404d-9458-72611f0c34ca","skill_id":"4aeb9f10-6043-46d6-9d75-c6e88879bd39","version":3,"content_hash":"v2:b959ebfd1043a07c0c4378ab94ca4342cb0259f5:2b340c906762e9279347223124b19d428213911cb632eeead7fcc3c3835fce47:2e6c3a689e19bee7533b10d3b9954e38873e6dc3d0db73ff4e693e627f8c92cb:0d23326beeddf352612d7065195e44ac","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static backtick findings are Markdown formatting or package names, not Ruby shell execution. Real risk remains because the skill uses the external belt CLI to run arbitrary Python and includes network-capable examples. No prompt injection attempt was found in the reviewed SKILL.md file.","remediation":[{"issue":"Broad belt command permission","severity":"high","suggestion":"Limit allowed tools to the exact belt app run workflow or document why full belt access is required."},{"issue":"Remote code execution boundary","severity":"medium","suggestion":"Warn users not to send secrets, credentials, or private data into code executed by the hosted service."},{"issue":"External install and network dependencies","severity":"low","suggestion":"Pin trusted install sources and explain that web requests from Python leave the sandbox."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":26,"line_start":19},{"file":"SKILL.md","line_end":33,"line_start":26},{"file":"SKILL.md","line_end":40,"line_start":33},{"file":"SKILL.md","line_end":47,"line_start":40},{"file":"SKILL.md","line_end":52,"line_start":47},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":58,"line_start":55},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":71,"line_start":68},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":86,"line_start":82},{"file":"SKILL.md","line_end":90,"line_start":86},{"file":"SKILL.md","line_end":94,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":102,"line_start":98},{"file":"SKILL.md","line_end":106,"line_start":102},{"file":"SKILL.md","line_end":111,"line_start":106},{"file":"SKILL.md","line_end":115,"line_start":111},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":127,"line_start":123},{"file":"SKILL.md","line_end":131,"line_start":127},{"file":"SKILL.md","line_end":133,"line_start":131},{"file":"SKILL.md","line_end":139,"line_start":133},{"file":"SKILL.md","line_end":143,"line_start":139},{"file":"SKILL.md","line_end":149,"line_start":143},{"file":"SKILL.md","line_end":166,"line_start":149},{"file":"SKILL.md","line_end":166,"line_start":166},{"file":"SKILL.md","line_end":180,"line_start":171}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":186,"line_start":186}]}],"critical_findings":[],"high_findings":[{"title":"Arbitrary Python Execution Through External Service","locations":[{"file":"SKILL.md","line_end":4,"line_start":3},{"file":"SKILL.md","line_end":25,"line_start":23},{"file":"SKILL.md","line_end":165,"line_start":160}],"confidence":0.92,"description":"The skill grants Bash(belt *) and instructs the agent to send Python code to infsh/python-executor. This creates remote code execution and data exposure risk if prompts include secrets.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The frontmatter permits Bash(belt *) and the quick start sends Python code through belt. The use cases also state that the skill can run any Python script."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.82,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This line tells users to run npx to install an external skill, which can execute third-party package code. It is documented behavior, but it is a real supply-chain risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":17,"line_start":17}],"confidence":0.65,"description":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line declares dependence on the external belt CLI and links to remote install instructions. This is legitimate dependency documentation, but it expands trust beyond the local skill."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":19}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The quick-start block runs belt login and belt app run with a Python payload. That intentionally invokes an external CLI to execute code through a hosted service."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":86,"line_start":82}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example runs belt app run with Python that fetches a web page. It combines external command execution with network-capable code."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":94,"line_start":90}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example invokes belt app run to execute Python for data analysis. The command is hardcoded, but the skill behavior is remote code execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":102,"line_start":98}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example invokes belt app run to execute Python for image generation. This is intended functionality, but it is still external code execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":111,"line_start":106}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example invokes belt app run to execute Python for video creation. This confirms the skill can run nontrivial code through an external CLI."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":119,"line_start":115}],"confidence":0.82,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example invokes belt app run to execute Python for 3D model processing. The operation is documented, but it remains external code execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":127,"line_start":123}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example invokes belt app run with Python that calls the GitHub API. It demonstrates external command execution and outbound network access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":149,"line_start":143}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The variants block documents belt app run commands for default and high-memory execution. These are real external CLI invocations for code execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":166,"line_start":149}],"confidence":0.72,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This range includes use-case text saying the skill can run any Python script. That broad execution intent is a real code-execution risk even though the static trigger is noisy."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":180,"line_start":171}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The related-skills block suggests npx skills add commands for additional external skills. Optional install commands introduce third-party execution risk if followed."}],"low_findings":[{"title":"Python HTTP libraries","locations":[{"file":"SKILL.md","line_end":84,"line_start":84}],"confidence":0.93,"description":"\"code\": \"import requests\\nfrom bs4 import BeautifulSoup\\n\\nresponse = requests.get(\\\"https://example","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The example imports requests and performs an HTTP GET from sandboxed Python. This confirms network egress capability, although the target is a benign sample domain."},{"title":"Python HTTP libraries","locations":[{"file":"SKILL.md","line_end":125,"line_start":125}],"confidence":0.93,"description":"\"code\": \"import requests\\nimport json\\n\\nresponse = requests.get(\\\"https://api.github.com/users/octo","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The example imports requests and calls the GitHub API from sandboxed Python. This confirms outbound network capability in normal skill use."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.8,"description":"description: \"Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The description states execution is via inference.sh, so the skill depends on a remote service. This is a network dependency, not evidence of malicious exfiltration."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":17,"line_start":17}],"confidence":0.68,"description":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The line links to remote install instructions for the required CLI. This is not malicious by itself, but it creates an external dependency users must trust."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":84,"line_start":84}],"confidence":0.9,"description":"\"code\": \"import requests\\nfrom bs4 import BeautifulSoup\\n\\nresponse = requests.get(\\\"https://example","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The web scraping example contains a hardcoded public URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":125,"line_start":125}],"confidence":0.9,"description":"\"code\": \"import requests\\nimport json\\n\\nresponse = requests.get(\\\"https://api.github.com/users/octo","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The API example contains a hardcoded GitHub API URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":188,"audit_model":"codex","audited_at":"2026-07-08T14:27:16.504+00:00","created_at":"2026-07-10T12:21:41.663723+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| App ID | `infsh/python-executor` |","category":"external_commands","line_end":40,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":47,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":52,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `requests`, `httpx`, `aiohttp` - HTTP clients","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `beautifulsoup4`, `lxml` - HTML/XML parsing","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `selenium`, `playwright` - Browser automation","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scrapy` - Web scraping framework","category":"external_commands","line_end":58,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `numpy`, `pandas`, `scipy` - Numerical computing","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `matplotlib`, `seaborn`, `plotly` - Visualization","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `pillow`, `opencv-python-headless` - Image manipulation","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scikit-image`, `imageio` - Image algorithms","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `moviepy` - Video editing","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `av` (PyAV), `ffmpeg-python` - Video processing","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `pydub` - Audio manipulation","category":"external_commands","line_end":71,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `trimesh`, `open3d` - 3D mesh processing","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `numpy-stl`, `meshio`, `pyvista` - 3D file formats","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `svgwrite`, `cairosvg` - SVG creation","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `reportlab`, `pypdf2` - PDF generation","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":86,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":94,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":102,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":106,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":111,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":131,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Files saved to `outputs/` are automatically returned:","category":"external_commands","line_end":133,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":139,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":149,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":166,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Non-interactive** - Use `plt.savefig()` not `plt.show()`","category":"external_commands","line_end":166,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":180,"severity":"medium","line_start":171},{"id":"network:SKILL.md:84:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"\"code\": \"import requests\\nfrom bs4 import BeautifulSoup\\n\\nresponse = requests.get(\\\"https://example","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"network:SKILL.md:125:python-http-libraries","file":"SKILL.md","pattern":"Python HTTP libraries","snippet":"\"code\": \"import requests\\nimport json\\n\\nresponse = requests.get(\\\"https://api.github.com/users/octo","category":"network","line_end":125,"severity":"low","line_start":125},{"id":"network:SKILL.md:3:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"description: \"Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen","category":"network","line_end":3,"severity":"low","line_start":3},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![Python Code Executor](https://cloud.inference.sh/u/33sqbmzt3mrg2xxphnhw5g5ear/01k8d8b4mckh6z89dhtx","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:84:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"code\": \"import requests\\nfrom bs4 import BeautifulSoup\\n\\nresponse = requests.get(\\\"https://example","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"network:SKILL.md:125:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"code\": \"import requests\\nimport json\\n\\nresponse = requests.get(\\\"https://api.github.com/users/octo","category":"network","line_end":125,"severity":"low","line_start":125},{"id":"network:SKILL.md:184:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":184,"severity":"low","line_start":184},{"id":"network:SKILL.md:185:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [App Code](https://inference.sh/docs/extend/app-code) - Understanding app execution","category":"network","line_end":185,"severity":"low","line_start":185},{"id":"network:SKILL.md:186:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Sandboxed Code Execution](https://inference.sh/blog/tools/sandboxed-execution) - Safe code execut","category":"network","line_end":186,"severity":"low","line_start":186},{"id":"blocker:SKILL.md:165:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- **Safe execution** - Runs in isolated subprocess","category":"blocker","line_end":166,"severity":"low","line_start":165}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"This line tells users to run npx to install an external skill, which can execute third-party package code. It is documented behavior, but it is a real supply-chain risk.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The line declares dependence on the external belt CLI and links to remote install instructions. This is legitimate dependency documentation, but it expands trust beyond the local skill.","verdict":"confirmed","severity":"medium","confidence":0.65},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The quick-start block runs belt login and belt app run with a Python payload. That intentionally invokes an external CLI to execute code through a hosted service.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and static app details only. No shell command or executable backtick expression is present in the cited lines.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The app id is shown as inline documentation and the next section begins an input schema. This is not command execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The cited block is a JSON input schema example. Markdown fences are not executable Ruby or shell backticks.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This range contains Markdown structure and a package list heading. It does not invoke a shell command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The line lists Python HTTP library names inside Markdown inline code. It does not execute those packages or a shell command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The line lists parser library names inside Markdown inline code. There is no command invocation at this location.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The line lists browser automation library names as documentation. It does not launch browsers or execute shell commands.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The range lists Python package categories in Markdown. It contains no executable shell syntax or user-controlled command construction.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The line lists numerical Python package names in Markdown inline code. It is documentation, not command execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The line lists visualization package names in Markdown inline code. No shell command is present.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The line lists image processing package names in Markdown inline code. It does not execute a command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The line lists image algorithm package names in Markdown inline code. There is no external command invocation.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The range lists media package names in Markdown. It does not run ffmpeg, Python, or shell commands at this location.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The line lists video processing package names in Markdown inline code. It is not shell backtick execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The range lists audio and 3D package names in Markdown. It does not invoke a process.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The line lists 3D mesh package names in Markdown inline code. No executable command is present.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The line lists 3D format package names in Markdown inline code. It is documentation only.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The line lists graphics package names in Markdown inline code. It does not execute shell commands.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The line lists document package names in Markdown inline code. There is no command execution at this line.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The example runs belt app run with Python that fetches a web page. It combines external command execution with network-capable code.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the next example heading. No command invocation is present in the cited lines.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The example invokes belt app run to execute Python for data analysis. The command is hardcoded, but the skill behavior is remote code execution.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the image processing heading. It is not executable shell syntax.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The example invokes belt app run to execute Python for image generation. This is intended functionality, but it is still external code execution.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the video creation heading. It does not run a command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The example invokes belt app run to execute Python for video creation. This confirms the skill can run nontrivial code through an external CLI.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the 3D model heading. There is no shell command in the cited lines.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The example invokes belt app run to execute Python for 3D model processing. The operation is documented, but it remains external code execution.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence, an API heading, and a new fence marker. The command itself is outside this cited range.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The example invokes belt app run with Python that calls the GitHub API. It demonstrates external command execution and outbound network access.","verdict":"confirmed","severity":"medium","confidence":0.9},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the file output section. It does not invoke an external process.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The line describes the outputs directory and opens a Python example. It is file-output documentation, not shell execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The cited block is a Python file-output example. It is not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"This range contains a closing Markdown fence and the variants heading. No command is present until the following cited block.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The variants block documents belt app run commands for default and high-memory execution. These are real external CLI invocations for code execution.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"This range includes use-case text saying the skill can run any Python script. That broad execution intent is a real code-execution risk even though the static trigger is noisy.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The line advises saving plots instead of showing them interactively. Inline code names are not command execution.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The related-skills block suggests npx skills add commands for additional external skills. Optional install commands introduce third-party execution risk if followed.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"network:SKILL.md:84:python-http-libraries","reason":"The example imports requests and performs an HTTP GET from sandboxed Python. This confirms network egress capability, although the target is a benign sample domain.","verdict":"confirmed","severity":"low","confidence":0.93},{"id":"network:SKILL.md:125:python-http-libraries","reason":"The example imports requests and calls the GitHub API from sandboxed Python. This confirms outbound network capability in normal skill use.","verdict":"confirmed","severity":"low","confidence":0.93},{"id":"network:SKILL.md:3:hardcoded-url","reason":"The description states execution is via inference.sh, so the skill depends on a remote service. This is a network dependency, not evidence of malicious exfiltration.","verdict":"confirmed","severity":"low","confidence":0.8},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is a documentation image asset. It does not cause skill runtime network access or transfer executed-code data.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The line links to remote install instructions for the required CLI. This is not malicious by itself, but it creates an external dependency users must trust.","verdict":"confirmed","severity":"low","confidence":0.68},{"id":"network:SKILL.md:84:hardcoded-url","reason":"The web scraping example contains a hardcoded public URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior.","verdict":"confirmed","severity":"low","confidence":0.9},{"id":"network:SKILL.md:125:hardcoded-url","reason":"The API example contains a hardcoded GitHub API URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior.","verdict":"confirmed","severity":"low","confidence":0.9},{"id":"network:SKILL.md:184:hardcoded-url","reason":"The URL is a documentation link about running apps. It is not a runtime network request made by the skill.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:185:hardcoded-url","reason":"The URL is a documentation link about app code. It is not evidence of data exfiltration or runtime network access.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:186:hardcoded-url","reason":"The URL is a documentation link about sandboxed execution. It is reference material, not executable network behavior.","verdict":"false_positive","confidence":0.88},{"id":"blocker:SKILL.md:165:network-reconnaissance","reason":"The cited lines say execution is isolated and plotting is non-interactive. No network scanning, host discovery, or reconnaissance instruction is present.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Arbitrary Python Execution Through External Service","severity":"high","locations":[{"file":"SKILL.md","line_end":4,"line_start":3},{"file":"SKILL.md","line_end":25,"line_start":23},{"file":"SKILL.md","line_end":165,"line_start":160}],"confidence":0.92,"description":"The skill grants Bash(belt *) and instructs the agent to send Python code to infsh/python-executor. This creates remote code execution and data exposure risk if prompts include secrets.","confidence_reasoning":"The frontmatter permits Bash(belt *) and the quick start sends Python code through belt. The use cases also state that the skill can run any Python script."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":18,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}