{"data":{"skill":{"slug":"halt-catch-fire-character-design-sheet","name":"character-design-sheet","icon":"📦","repo":"https://github.com/halt-catch-fire/skills/tree/main/guides/design/character-design-sheet/","status":"approved","author":"halt-catch-fire","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"3a76c11d-38a5-4e52-af09-3368d3a0de59","skill_id":"4ff2c523-143a-4e78-918a-ed389093bf2d","version":3,"content_hash":"v2:a06681402992ceae98ba04d54cfd4ab004862696:df75a3bcbcec6ed8f4c1a42508d22c8b1c1e1b59e12b7373402f0098b4bf8b60:515936b20fd50cd6fcd3daa8b6a40d6f55fbadf2b7df32553947fdb5725475f9:6cc0eedb8abc3cbb1753c8c211b201d4","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The skill is not malicious, but it depends on broad belt CLI access and third-party inference services. Real command and network findings were confirmed, while markdown diagrams, templates, and the line 207 reconnaissance hit were dismissed as false positives. Publication should require clear user confirmation for login, installs, remote app runs, and possible service costs.","remediation":[{"issue":"Broad Bash(belt *) permission","severity":"medium","suggestion":"Narrow allowed tools to required belt subcommands, or require explicit confirmation before login, app listing, and remote job execution."},{"issue":"Third-party inference execution","severity":"medium","suggestion":"Tell users before execution that prompts, image references, and LoRA paths may be sent to inference.sh or model providers."},{"issue":"External installation recommendations","severity":"medium","suggestion":"Keep npx skill-install commands as optional manual steps, and avoid asking agents to execute them automatically."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":26,"line_start":17},{"file":"SKILL.md","line_end":49,"line_start":26},{"file":"SKILL.md","line_end":56,"line_start":49},{"file":"SKILL.md","line_end":58,"line_start":56},{"file":"SKILL.md","line_end":92,"line_start":58},{"file":"SKILL.md","line_end":98,"line_start":92},{"file":"SKILL.md","line_end":106,"line_start":98},{"file":"SKILL.md","line_end":110,"line_start":106},{"file":"SKILL.md","line_end":133,"line_start":110},{"file":"SKILL.md","line_end":150,"line_start":133},{"file":"SKILL.md","line_end":160,"line_start":150},{"file":"SKILL.md","line_end":168,"line_start":160},{"file":"SKILL.md","line_end":173,"line_start":168},{"file":"SKILL.md","line_end":177,"line_start":173},{"file":"SKILL.md","line_end":184,"line_start":177},{"file":"SKILL.md","line_end":204,"line_start":184},{"file":"SKILL.md","line_end":210,"line_start":204},{"file":"SKILL.md","line_end":233,"line_start":210},{"file":"SKILL.md","line_end":259,"line_start":233},{"file":"SKILL.md","line_end":274,"line_start":259},{"file":"SKILL.md","line_end":278,"line_start":274},{"file":"SKILL.md","line_end":280,"line_start":278}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":15,"line_start":15}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.72,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":17}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":92,"line_start":58}],"confidence":0.86,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This bash block runs several belt app run commands and a stitch-images job. The commands are fixed examples, but they still invoke external processing through the belt CLI."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":133,"line_start":110}],"confidence":0.84,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The expression sheet example contains belt app run commands for remote image generation. There is no command injection evidence, but the external CLI execution risk is real."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":210,"line_start":204}],"confidence":0.83,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The LoRA example invokes belt app run with a local LoRA path and remote model. This can transmit prompt and file reference data to an external inference workflow."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":278,"line_start":274}],"confidence":0.74,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The related skills block provides npx skills add commands for additional external skill installs. They are optional documentation, but they remain shell commands that fetch external content."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":280,"line_start":278}],"confidence":0.64,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use."},{"title":"Overbroad Belt CLI Permission","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":21,"line_start":18}],"confidence":0.86,"description":"The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":11,"line_start":11}],"confidence":0.78,"description":"Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":15,"line_start":15}],"confidence":0.68,"description":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":282,"audit_model":"codex","audited_at":"2026-07-06T16:37:16.987+00:00","created_at":"2026-07-06T17:32:29.164202+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":58,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":92,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":106,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":110,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":133,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":160,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":168,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":173,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":177,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":184,"severity":"medium","line_start":177},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":204,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":210,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":233,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```markdown","category":"external_commands","line_end":259,"severity":"medium","line_start":233},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":274,"severity":"medium","line_start":259},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":278,"severity":"medium","line_start":274},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":280,"severity":"medium","line_start":278},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"blocker:SKILL.md:207:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"\"prompt\": \"maya_chen character, sitting at a cafe reading a book, warm afternoon light, candid photo","category":"blocker","line_end":207,"severity":"low","line_start":207}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This line uses inline code to name the belt CLI and links install documentation. It does not execute a command or construct shell input.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This range is markdown structure and explanatory prose after the quick start. It contains no executable command beyond the already reviewed quick start block.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"This fenced block is an ASCII turnaround sheet diagram. It is not Ruby or shell execution and contains no command text.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This range only closes the diagram and opens the next example section. It does not include executable command content.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This bash block runs several belt app run commands and a stitch-images job. The commands are fixed examples, but they still invoke external processing through the belt CLI.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"This range is the end of the turnaround example plus expression-sheet prose. It does not contain shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This fenced block is an ASCII expression sheet diagram. It is visual documentation, not an executable command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"This range closes a diagram and states the minimum expression list. It contains no command execution pattern.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The expression sheet example contains belt app run commands for remote image generation. There is no command injection evidence, but the external CLI execution risk is real.","verdict":"confirmed","severity":"medium","confidence":0.84},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"This range is markdown prose and a costume table after the expression command block. It does not include a shell command.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"This fenced block documents a color palette with hex values. It is not executable code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"This range transitions from the palette block to a description template. It contains no shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"This fenced block is a natural-language description template. It is not Ruby or shell code.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"This range only closes a template and introduces an example. It does not contain executable command text.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:177:ruby-shell-backtick-execution","reason":"This fenced block is a sample character description. It is prompt prose, not a shell command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"This range is prose and a proportions table before the LoRA command example. It does not execute anything itself.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The LoRA example invokes belt app run with a local LoRA path and remote model. This can transmit prompt and file reference data to an external inference workflow.","verdict":"confirmed","severity":"medium","confidence":0.83},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"This range closes the LoRA command block and lists training tips. It contains no shell command execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:233:ruby-shell-backtick-execution","reason":"This fenced markdown block is a character bible template. It is documentation content, not executable shell code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:259:ruby-shell-backtick-execution","reason":"This range closes the character bible template and introduces related skills. It does not include the install commands themselves.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","reason":"The related skills block provides npx skills add commands for additional external skill installs. They are optional documentation, but they remain shell commands that fetch external content.","verdict":"confirmed","severity":"medium","confidence":0.74},{"id":"external_commands:SKILL.md:278:ruby-shell-backtick-execution","reason":"The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use.","verdict":"confirmed","severity":"medium","confidence":0.64},{"id":"network:SKILL.md:11:hardcoded-url","reason":"Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing.","verdict":"confirmed","severity":"low","confidence":0.78},{"id":"network:SKILL.md:15:hardcoded-url","reason":"Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency.","verdict":"confirmed","severity":"low","confidence":0.68},{"id":"blocker:SKILL.md:207:system-reconnaissance","reason":"Line 207 is an image prompt describing a character reading a book at a cafe. It is not system reconnaissance or an attempt to inspect the host environment.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Overbroad Belt CLI Permission","severity":"medium","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":21,"line_start":18}],"confidence":0.86,"description":"The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.","confidence_reasoning":"The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":9,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}