{"data":{"skill":{"slug":"infsh-skills-ai-image-generation","name":"ai-image-generation","icon":"📦","repo":"https://github.com/infsh-skills/skills/tree/main/tools/image/ai-image-generation/","status":"approved","author":"infsh-skills","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"e20cdb84-3c17-4876-9881-88b6c6e8fc40","skill_id":"7105a93c-44eb-4959-9b13-50fa0966722b","version":5,"content_hash":"v3:4121de961d1b6f2ffca856260e239505c302452c:93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e:2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca:736b696c6c732f696e6673682d736b696c6c732f61692d696d6167652d67656e65726174696f6e:a07787de08ce2e393a0ec576d88fdae9","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The reported shell backtick findings are Markdown formatting, not Ruby or shell command substitution. Most URLs are documentation or placeholders, but the remote image can contact an external host when rendered. The broad Bash(belt *) permission remains a medium-risk capability because it permits more CLI actions than this image workflow requires.","remediation":[{"issue":"The allowed-tools declaration permits every belt subcommand.","severity":"medium","suggestion":"Restrict automatic Bash access to required image listing and generation commands, or remove the blanket allowance and require command confirmation."},{"issue":"The skill embeds an image hosted on an external inference.sh domain.","severity":"low","suggestion":"Package the image with the skill or use a marketplace-hosted asset to avoid automatic requests to an external host."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":31,"line_start":24},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":58,"line_start":52},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":67,"line_start":63},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":76,"line_start":72},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":84,"line_start":80},{"file":"SKILL.md","line_end":86,"line_start":84},{"file":"SKILL.md","line_end":90,"line_start":86},{"file":"SKILL.md","line_end":94,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":111,"line_start":107},{"file":"SKILL.md","line_end":115,"line_start":111},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":129,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":129},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":162,"line_start":138},{"file":"SKILL.md","line_end":164,"line_start":162}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":170,"line_start":170}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Broad Belt CLI Permission","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.96,"description":"The allowed-tools declaration permits every belt subcommand, although the documented workflow only needs image discovery and generation commands.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The wildcard permission is explicit and broader than the commands documented in the skill. This increases the impact of incorrect or manipulated tool use."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.9,"description":"![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The Markdown image references an external host, so rendering the skill can make an automatic network request and disclose basic request metadata."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":172,"audit_model":"codex","audited_at":"2026-08-06T11:50:00.159+00:00","created_at":"2026-08-07T03:07:40.35208+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **GPT-Image-2** | `openai/gpt-image-2` | Text-to-image, editing, inpainting |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX Dev LoRA | `falai/flux-dev-lora` | High quality with custom styles |","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX.2 Klein LoRA | `falai/flux-2-klein-lora` | Fast with LoRA support (4B/9B) |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image** | `pruna/p-image` | Fast, economical, multiple aspects |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image-LoRA** | `pruna/p-image-lora` | Fast with preset LoRA styles |","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image-Edit** | `pruna/p-image-edit` | Fast image editing |","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Gemini 3 Pro | `google/gemini-3-pro-image-preview` | Google's latest |","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Gemini 2.5 Flash | `google/gemini-2-5-flash-image` | Fast Google model |","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Grok Imagine | `xai/grok-imagine-image` | xAI's model, multiple aspects |","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 4.5 | `bytedance/seedream-4-5` | 2K-4K cinematic quality |","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 4.0 | `bytedance/seedream-4-0` | High quality 2K-4K |","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 3.0 | `bytedance/seedream-3-0-t2i` | Accurate text rendering |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Reve | `falai/reve` | Natural language editing, text rendering |","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ImagineArt 1.5 Pro | `falai/imagine-art-1-5-pro-preview` | Ultra-high-fidelity 4K |","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX Klein 4B | `pruna/flux-klein-4b` | Ultra-cheap ($0.0001/image) |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Topaz Upscaler | `falai/topaz-image-upscaler` | Professional upscaling |","category":"external_commands","line_end":50,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":58,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":63,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":72,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":84,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":86,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":94,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":103,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":111,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":125,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":129,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":162,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":162},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Generate images with 50+ AI models via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:70:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"images\": [\"https://your-image.jpg\"]","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:SKILL.md:124:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"belt app run falai/topaz-image-upscaler --input '{\"image_url\": \"https://...\"}'","category":"network","line_end":124,"severity":"low","line_start":124},{"id":"network:SKILL.md:131:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"images\": [\"https://img1.jpg\", \"https://img2.jpg\"],","category":"network","line_end":131,"severity":"low","line_start":131},{"id":"network:SKILL.md:168:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":168,"severity":"low","line_start":168},{"id":"network:SKILL.md:169:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Image Generation Example](https://inference.sh/docs/examples/image-generation) - Complete image g","category":"network","line_end":169,"severity":"low","line_start":169},{"id":"network:SKILL.md:170:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":170,"severity":"low","line_start":170}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The backticks delimit an inline Markdown command example. They do not perform Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks format the belt executable name in prose. No execution construct exists on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks format a model identifier in a Markdown table. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This is the opening delimiter of a Markdown Bash example. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"This is the closing delimiter of a Markdown code block. It does not execute the examples.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:11:hardcoded-url","reason":"The URL is a user-facing link to the named service. It is not used by executable code or for data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The Markdown image references an external host, so rendering the skill can make an automatic network request and disclose basic request metadata.","verdict":"confirmed","severity":"low","confidence":0.9},{"id":"network:SKILL.md:17:hardcoded-url","reason":"This is a visible link to installation documentation on GitHub. The skill does not fetch or execute its contents.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:70:hardcoded-url","reason":"This is an explicit placeholder for a user-supplied image URL in an editing example. It is not a hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:124:hardcoded-url","reason":"The ellipsis URL is a placeholder for the image selected by the user. It does not identify a real remote endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:131:hardcoded-url","reason":"These example URLs are placeholders for user-selected images. They do not identify real remote endpoints.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:168:hardcoded-url","reason":"This is a visible documentation link for the service used by the skill. No automatic request is instructed.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:169:hardcoded-url","reason":"This is a visible documentation link for the service used by the skill. No automatic request is instructed.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:170:hardcoded-url","reason":"This is a visible documentation link for the service used by the skill. No automatic request is instructed.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Broad Belt CLI Permission","severity":"medium","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.96,"description":"The allowed-tools declaration permits every belt subcommand, although the documented workflow only needs image discovery and generation commands.","confidence_reasoning":"The wildcard permission is explicit and broader than the commands documented in the skill. This increases the impact of incorrect or manipulated tool use."}],"subject_marketplace_commit_sha":"4121de961d1b6f2ffca856260e239505c302452c","subject_content_hash":"93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e","subject_tree_hash":"2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca","subject_plugin_path":"skills/infsh-skills/ai-image-generation","audit_payload_hash":"a07787de08ce2e393a0ec576d88fdae9","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"4121de961d1b6f2ffca856260e239505c302452c","contentHash":"93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e","treeHash":"2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca","pluginPath":"skills/infsh-skills/ai-image-generation","auditPayloadHash":"a07787de08ce2e393a0ec576d88fdae9"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/infsh-skills-ai-image-generation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}