{"data":{"skill":{"slug":"halt-catch-fire-storyboard-creation","name":"storyboard-creation","icon":"📦","repo":"https://github.com/halt-catch-fire/skills/tree/main/guides/video/storyboard-creation/","status":"approved","author":"halt-catch-fire","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"6f22cb9b-b720-4325-87da-42e68e6ecd5d","skill_id":"8079638c-97f5-43ff-ba02-42a9470f7bf3","version":3,"content_hash":"v3:30c73eac2afe762f6aa9c4553158769369d47351:7e5b91d6595a7b47177183b45f33a6e1a94345228146c2ee52197381cec47ed3:eb6c02e112fb062a3aacc81ef99f39c1ebe82921e5a83ecba6448cc4a93805d2:736b696c6c732f68616c742d63617463682d666972652f73746f7279626f6172642d6372656174696f6e:776912c473316e418bda50d49b299487","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The main static alerts are Markdown code fences and inline code, with many false positives. Several cited sections do provide real belt or npx commands, and the skill has an intentional external image-generation dependency that can send storyboard prompts or image references to third-party services.","remediation":[{"issue":"External CLI execution in examples","severity":"medium","suggestion":"Keep only required belt commands in executable examples and move npx installation commands to a clearly marked manual setup section."},{"issue":"Third-party prompt and image disclosure","severity":"medium","suggestion":"Add a privacy note that prompts, script details, and image references may be sent to inference.sh or FAL apps when using belt."},{"issue":"Hardcoded external setup links","severity":"low","suggestion":"Pin trusted installation documentation and advise users to verify the CLI source before installing or logging in."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":32,"line_start":17},{"file":"SKILL.md","line_end":50,"line_start":32},{"file":"SKILL.md","line_end":71,"line_start":50},{"file":"SKILL.md","line_end":107,"line_start":71},{"file":"SKILL.md","line_end":115,"line_start":107},{"file":"SKILL.md","line_end":123,"line_start":115},{"file":"SKILL.md","line_end":127,"line_start":123},{"file":"SKILL.md","line_end":133,"line_start":127},{"file":"SKILL.md","line_end":136,"line_start":133},{"file":"SKILL.md","line_end":157,"line_start":136},{"file":"SKILL.md","line_end":172,"line_start":157},{"file":"SKILL.md","line_end":180,"line_start":172},{"file":"SKILL.md","line_end":190,"line_start":180},{"file":"SKILL.md","line_end":196,"line_start":190},{"file":"SKILL.md","line_end":217,"line_start":196},{"file":"SKILL.md","line_end":221,"line_start":217},{"file":"SKILL.md","line_end":238,"line_start":221},{"file":"SKILL.md","line_end":261,"line_start":238},{"file":"SKILL.md","line_end":266,"line_start":261},{"file":"SKILL.md","line_end":268,"line_start":266}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":15,"line_start":15}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.78,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 7 instructs users to install a CLI skill through npx, which can execute package-managed code and fetch dependencies. This is setup guidance, but it is still a real external command risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":32,"line_start":17}],"confidence":0.86,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 17-32 contain bash examples for belt login and belt app run against external apps. The commands are intentional, but they execute an external CLI and send inputs outside the local environment."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":71,"line_start":50}],"confidence":0.86,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 50-71 contain bash examples invoking belt app run for image generation. These are real external CLI commands, even though they match the skill purpose."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":217,"line_start":196}],"confidence":0.87,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 196-217 define a shell variable and run multiple belt app run commands. The examples intentionally execute an external CLI and submit storyboard prompts to remote apps."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":238,"line_start":221}],"confidence":0.85,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 221-238 contain bash examples that call belt app run to stitch images. This can process or transfer image references through an external CLI workflow."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":266,"line_start":261}],"confidence":0.82,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Lines 261-266 contain npx skills add commands for related skills. Installing additional community skills is a real external command and dependency risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":268,"line_start":266}],"confidence":0.66,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This range includes the inline belt app store command after the closing fence. It is a low-complexity command, but it still invokes the external belt CLI."},{"title":"Third-Party Prompt and Image Processing","locations":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":31,"line_start":21},{"file":"SKILL.md","line_end":216,"line_start":201},{"file":"SKILL.md","line_end":237,"line_start":223}],"confidence":0.84,"description":"The workflow sends storyboard prompts and image references to external inference.sh and FAL apps through the belt CLI. Users could expose unpublished scripts, client concepts, or generated image assets to third-party services.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The skill explicitly describes AI image generation through inference.sh and provides belt app run examples with storyboard prompts and image stitching inputs. The behavior appears intended and useful, but it creates a clear third-party data exposure concern."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":11,"line_start":11}],"confidence":0.74,"description":"Create visual storyboards with AI image generation via [inference.sh](https://inference.sh) CLI.","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Line 11 hardcodes the inference.sh provider URL, and the skill is designed around that external service. This is an expected network dependency, but users should know prompts may leave the local environment."},{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":15,"line_start":15}],"confidence":0.68,"description":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"Line 15 links to raw GitHub install instructions for the belt CLI. It is documentation rather than automatic access, but it is still an external setup dependency."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":270,"audit_model":"codex","audited_at":"2026-07-05T15:06:57.547+00:00","created_at":"2026-07-17T16:56:42.973066+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":32,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":71,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":133,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":136,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":172,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":180,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":196,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":217,"severity":"medium","line_start":196},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":221,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":238,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":261,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":266,"severity":"medium","line_start":261},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":268,"severity":"medium","line_start":266},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Create visual storyboards with AI image generation via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:15:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":15,"severity":"low","line_start":15}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Line 7 instructs users to install a CLI skill through npx, which can execute package-managed code and fetch dependencies. This is setup guidance, but it is still a real external command risk.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"Line 15 uses inline Markdown around the tool name and links to install instructions. It does not contain an executable command on that line.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Lines 17-32 contain bash examples for belt login and belt app run against external apps. The commands are intentional, but they execute an external CLI and send inputs outside the local environment.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This range starts at a Markdown code fence close and continues into reference tables and prose. No executable command is present in the cited content.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Lines 50-71 contain bash examples invoking belt app run for image generation. These are real external CLI commands, even though they match the skill purpose.","verdict":"confirmed","severity":"medium","confidence":0.86},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"This range starts at a Markdown fence close and then describes camera angles and movement. It does not direct execution of a command.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"Lines 107-115 are an ASCII diagram for the 180-degree rule. The backticks are Markdown formatting, not shell execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The cited range is prose about continuity and match on action. It contains no command invocation or executable script.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"Lines 123-127 are a storyboard action example in a plain Markdown block. It is not a shell command or dynamic code execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The cited range contains explanatory text about eyeline match. There is no executable command in this section.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"Lines 133-136 are a plain example of two storyboard panels. The Markdown fence is not an instruction to execute code.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"This range covers prose and a table about screen direction and panel layout. No shell command or code execution appears there.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"Lines 157-172 show a panel annotation template using box drawing text. It is documentation, not executable code.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"The cited range introduces the storyboard workflow and does not include a command. The static match is from Markdown fence context.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"Lines 180-190 are a sample shot list in a plain text block. It contains no shell syntax intended for execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"This range contains prose about generating panels and style consistency. No executable command is present until the next bash block.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:196:ruby-shell-backtick-execution","reason":"Lines 196-217 define a shell variable and run multiple belt app run commands. The examples intentionally execute an external CLI and submit storyboard prompts to remote apps.","verdict":"confirmed","severity":"medium","confidence":0.87},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"The cited range is the transition between sections and does not include executable command content. It is a Markdown boundary false positive.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"Lines 221-238 contain bash examples that call belt app run to stitch images. This can process or transfer image references through an external CLI workflow.","verdict":"confirmed","severity":"medium","confidence":0.85},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"This range starts at a code fence close and then lists style tips and common mistakes. It contains no executable command.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","reason":"Lines 261-266 contain npx skills add commands for related skills. Installing additional community skills is a real external command and dependency risk.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"This range includes the inline belt app store command after the closing fence. It is a low-complexity command, but it still invokes the external belt CLI.","verdict":"confirmed","severity":"medium","confidence":0.66},{"id":"network:SKILL.md:11:hardcoded-url","reason":"Line 11 hardcodes the inference.sh provider URL, and the skill is designed around that external service. This is an expected network dependency, but users should know prompts may leave the local environment.","verdict":"confirmed","severity":"low","confidence":0.74},{"id":"network:SKILL.md:15:hardcoded-url","reason":"Line 15 links to raw GitHub install instructions for the belt CLI. It is documentation rather than automatic access, but it is still an external setup dependency.","verdict":"confirmed","severity":"low","confidence":0.68}],"semantic_findings":[{"title":"Third-Party Prompt and Image Processing","severity":"medium","locations":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":31,"line_start":21},{"file":"SKILL.md","line_end":216,"line_start":201},{"file":"SKILL.md","line_end":237,"line_start":223}],"confidence":0.84,"description":"The workflow sends storyboard prompts and image references to external inference.sh and FAL apps through the belt CLI. Users could expose unpublished scripts, client concepts, or generated image assets to third-party services.","confidence_reasoning":"The skill explicitly describes AI image generation through inference.sh and provides belt app run examples with storyboard prompts and image stitching inputs. The behavior appears intended and useful, but it creates a clear third-party data exposure concern."}],"subject_marketplace_commit_sha":"30c73eac2afe762f6aa9c4553158769369d47351","subject_content_hash":"7e5b91d6595a7b47177183b45f33a6e1a94345228146c2ee52197381cec47ed3","subject_tree_hash":"eb6c02e112fb062a3aacc81ef99f39c1ebe82921e5a83ecba6448cc4a93805d2","subject_plugin_path":"skills/halt-catch-fire/storyboard-creation","audit_payload_hash":"776912c473316e418bda50d49b299487","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"30c73eac2afe762f6aa9c4553158769369d47351","contentHash":"7e5b91d6595a7b47177183b45f33a6e1a94345228146c2ee52197381cec47ed3","treeHash":"eb6c02e112fb062a3aacc81ef99f39c1ebe82921e5a83ecba6448cc4a93805d2","pluginPath":"skills/halt-catch-fire/storyboard-creation","auditPayloadHash":"776912c473316e418bda50d49b299487"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":9,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}