{"data":{"skill":{"slug":"infsh-skills-ai-video-generation","name":"ai-video-generation","icon":"📦","repo":"https://github.com/infsh-skills/skills/tree/main/tools/video/ai-video-generation/","status":"approved","author":"infsh-skills","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"bf7865c8-595c-41cc-bd9d-e83d7c754882","skill_id":"a83890fe-be4c-468c-b000-c42a013af7d7","version":5,"content_hash":"v3:4121de961d1b6f2ffca856260e239505c302452c:936b3fc40a465d49fcee14a1d1f21486e07caf1e4cb873d6e6b38f8939ca334f:6ff6ed94f18f8582cacfb9c699a6aa7e0de770ca8d98cf92d388d2a9a0b258ea:736b696c6c732f696e6673682d736b696c6c732f61692d766964656f2d67656e65726174696f6e:e79bbdbe51773c90d46c3e99c18a8aa0","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The skill contains genuine external command and network behavior through documented belt and npx workflows. Most static backtick matches are Markdown fences or model identifiers, but command examples, third-party installation, remote image loading, and external media processing remain relevant risks.","remediation":[{"issue":"The skill directs agents to run networked belt commands that may consume paid services.","severity":"medium","suggestion":"Require user confirmation before login or generation, and disclose expected provider, data transfer, and cost."},{"issue":"The installation examples use unpinned npx skill sources.","severity":"medium","suggestion":"Pin reviewed versions or immutable commits and direct users to verified installation documentation."},{"issue":"Portraits, audio, and videos can be submitted to external inference providers.","severity":"medium","suggestion":"Warn users not to submit confidential or unauthorized media and document provider retention and privacy terms."},{"issue":"The skill embeds an image from an external cloud host.","severity":"low","suggestion":"Use a marketplace-hosted asset or a privacy-preserving image proxy."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":33,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":43},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":71,"line_start":65},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":78},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":85,"line_start":83},{"file":"SKILL.md","line_end":91,"line_start":85},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":99,"line_start":95},{"file":"SKILL.md","line_end":104,"line_start":99},{"file":"SKILL.md","line_end":108,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":121,"line_start":116},{"file":"SKILL.md","line_end":125,"line_start":121},{"file":"SKILL.md","line_end":130,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":130},{"file":"SKILL.md","line_end":140,"line_start":134},{"file":"SKILL.md","line_end":144,"line_start":140},{"file":"SKILL.md","line_end":150,"line_start":144},{"file":"SKILL.md","line_end":154,"line_start":150},{"file":"SKILL.md","line_end":160,"line_start":154},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":170,"line_start":164}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":157,"line_start":157},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":249,"line_start":249},{"file":"SKILL.md","line_end":250,"line_start":250},{"file":"SKILL.md","line_end":251,"line_start":251}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":7,"line_start":7}],"confidence":0.99,"description":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"Line 7 instructs the user or agent to execute npx against a third-party skill source. This creates supply-chain and package-execution risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":24,"line_start":19}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example runs belt login and a networked model invocation. These commands cause authentication and external service side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":85,"line_start":83}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example runs belt app list against the external platform. This is intentional external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":95,"line_start":91}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes a hosted Veo model through belt. It causes external command, network, and potential billing side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":104,"line_start":99}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes a hosted Grok video model through belt. It causes external command, network, and potential billing side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":112,"line_start":108}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes Wan through belt with a remote image input. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":121,"line_start":116}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example sends portrait and audio references to OmniHuman through belt. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":130,"line_start":125}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example sends face and audio references to Fabric through belt. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":140,"line_start":134}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes Seedance through belt and requests generated audio. It causes external service and potential billing side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":150,"line_start":144}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes Seedance through belt with an external image reference. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":160,"line_start":154}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes Seedance through belt with a portrait reference. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":170,"line_start":164}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes HappyHorse through belt. It causes external command, network, and potential billing side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":179,"line_start":174}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes video editing through belt with a remote video. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":188,"line_start":183}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example sends portrait and audio references to PixVerse through belt. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":194,"line_start":192}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example invokes a hosted video upscaler through belt. It causes external command, network, and potential billing side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":203,"line_start":198}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example sends a video to a hosted foley model through belt. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":212,"line_start":207}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example sends two videos to the hosted media merger through belt. It performs external command and network activity."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":243,"line_start":216}],"confidence":0.99,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This fenced block contains nine npx installation commands for external skills. Executing them introduces third-party package and supply-chain risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":245,"line_start":243}],"confidence":0.95,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The detected span includes the direct instruction to run belt app list. This invokes the external CLI and platform."},{"title":"External Processing of Sensitive Media","locations":[{"file":"SKILL.md","line_end":121,"line_start":108},{"file":"SKILL.md","line_end":203,"line_start":174}],"confidence":0.98,"description":"The examples submit portrait, audio, and video references to hosted inference services. Users may expose personal, biometric, copyrighted, or confidential media.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The cited belt examples explicitly pass remote portrait, audio, and video URLs to hosted model applications."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.98,"description":"![AI Video Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The Markdown image embeds a remote inference.sh cloud asset. Rendering it causes a request to an external host and can disclose request metadata."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":253,"audit_model":"codex","audited_at":"2026-08-06T11:53:25.81+00:00","created_at":"2026-08-07T03:07:49.300776+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 Fast | `google/veo-3-1-fast` | Fast, with optional audio |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 | `google/veo-3-1` | Best quality, frame interpolation |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 | `google/veo-3` | High quality with audio |","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 Fast | `google/veo-3-fast` | Fast with audio |","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 2 | `google/veo-2` | Realistic videos |","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast, economical, with audio support |","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-T2V** | `pruna/wan-t2v` | Economical 480p/720p |","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Grok Video | `xai/grok-imagine-video` | xAI, configurable duration |","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Text/image/ref-to-video with sync audio, up to 1080p","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse T2V** | `alibaba/happyhorse-1-0-t2v` | Physically realistic, up to 15s |","category":"external_commands","line_end":49,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 | `falai/wan-2-5` | Animate any image |","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 I2V | `falai/wan-2-5-i2v` | High quality i2v |","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-I2V** | `pruna/wan-i2v` | Economical 480p/720p |","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast i2v with audio |","category":"external_commands","line_end":53,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Animate images with sync audio, up to 1080p |","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse I2V** | `alibaba/happyhorse-1-0-i2v` | Animate images, up to 1080P/15s |","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse R2V** | `alibaba/happyhorse-1-0-r2v` | Character-preserving from references |","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.5 | `bytedance/omnihuman-1-5` | Multi-character |","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.0 | `bytedance/omnihuman-1-0` | Single character |","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Fabric 1.0 | `falai/fabric-1-0` | Image talks with lipsync |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PixVerse Lipsync | `falai/pixverse-lipsync` | Realistic lipsync |","category":"external_commands","line_end":71,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HappyHorse Edit | `alibaba/happyhorse-1-0-video-edit` | Natural language video editing |","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HunyuanVideo Foley | `infsh/hunyuanvideo-foley` | Add sound effects to video |","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Topaz Upscaler | `falai/topaz-video-upscaler` | Upscale video quality |","category":"external_commands","line_end":79,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Media Merger | `infsh/media-merger` | Merge videos with transitions |","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":91,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":104,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":112,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":121,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":134,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":140,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":144,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":150,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":154,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":160,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":170,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":179,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":183,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":188,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":194,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":203,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":207,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":212,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":243,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":245,"severity":"medium","line_start":243},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Generate videos with 40+ AI models via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![AI Video Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:110:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://your-image.jpg\"","category":"network","line_end":110,"severity":"low","line_start":110},{"id":"network:SKILL.md:118:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:SKILL.md:119:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:127:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://face.jpg\",","category":"network","line_end":127,"severity":"low","line_start":127},{"id":"network:SKILL.md:128:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://audio.mp3\"","category":"network","line_end":128,"severity":"low","line_start":128},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image\": \"https://your-image.jpg\",","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:157:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"reference_image\": \"https://portrait.jpg\",","category":"network","line_end":157,"severity":"low","line_start":157},{"id":"network:SKILL.md:176:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://your-video.mp4\",","category":"network","line_end":176,"severity":"low","line_start":176},{"id":"network:SKILL.md:185:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":185,"severity":"low","line_start":185},{"id":"network:SKILL.md:186:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":186,"severity":"low","line_start":186},{"id":"network:SKILL.md:193:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"belt app run falai/topaz-video-upscaler --input '{\"video_url\": \"https://...\"}'","category":"network","line_end":193,"severity":"low","line_start":193},{"id":"network:SKILL.md:200:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://silent-video.mp4\",","category":"network","line_end":200,"severity":"low","line_start":200},{"id":"network:SKILL.md:209:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"videos\": [\"https://clip1.mp4\", \"https://clip2.mp4\"],","category":"network","line_end":209,"severity":"low","line_start":209},{"id":"network:SKILL.md:249:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":249,"severity":"low","line_start":249},{"id":"network:SKILL.md:250:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Streaming Results](https://inference.sh/docs/api/sdk/streaming) - Real-time progress updates","category":"network","line_end":250,"severity":"low","line_start":250},{"id":"network:SKILL.md:251:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Content Pipeline Example](https://inference.sh/docs/examples/content-pipeline) - Building media w","category":"network","line_end":251,"severity":"low","line_start":251}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"Line 7 instructs the user or agent to execute npx against a third-party skill source. This creates supply-chain and package-execution risk.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks only format the belt executable name in prose. This line does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The fenced example runs belt login and a networked model invocation. These commands cause authentication and external service side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The detected text is a Markdown fence terminator followed by headings and a table. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks format the google/veo-3-1-fast model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Backticks format the google/veo-3-1 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Backticks format the google/veo-3 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Backticks format the google/veo-3-fast model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format the google/veo-2 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Backticks format the pruna/p-video model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Backticks format the pruna/wan-t2v model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"Backticks format the xai/grok-imagine-video model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/seedance-2-0 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/seedance-2-0-fast model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The match is inline formatting for the alibaba/happyhorse-1-0-t2v identifier. The surrounding lines contain only table content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Backticks format the falai/wan-2-5 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Backticks format the falai/wan-2-5-i2v model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Backticks format the pruna/wan-i2v model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"Backticks format the pruna/p-video model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/seedance-2-0 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/seedance-2-0-fast model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"Backticks format the alibaba/happyhorse-1-0-i2v model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The match is inline formatting for the alibaba/happyhorse-1-0-r2v identifier. The surrounding lines contain only table content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/omnihuman-1-5 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Backticks format the bytedance/omnihuman-1-0 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Backticks format the falai/fabric-1-0 model identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The match is inline formatting for the falai/pixverse-lipsync identifier. The surrounding lines contain only table content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The match is inline formatting for the HappyHorse editor identifier. The surrounding lines contain only table content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"Backticks format the infsh/hunyuanvideo-foley tool identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"Backticks format the falai/topaz-video-upscaler tool identifier in a Markdown table. No command is executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The match is inline formatting for the infsh/media-merger identifier. The surrounding lines contain only table content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The fenced example runs belt app list against the external platform. This is intentional external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The fenced example invokes a hosted Veo model through belt. It causes external command, network, and potential billing side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The fenced example invokes a hosted Grok video model through belt. It causes external command, network, and potential billing side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The fenced example invokes Wan through belt with a remote image input. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The fenced example sends portrait and audio references to OmniHuman through belt. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The fenced example sends face and audio references to Fabric through belt. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The fenced example invokes Seedance through belt and requests generated audio. It causes external service and potential billing side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The fenced example invokes Seedance through belt with an external image reference. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The fenced example invokes Seedance through belt with a portrait reference. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The fenced example invokes HappyHorse through belt. It causes external command, network, and potential billing side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The fenced example invokes video editing through belt with a remote video. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The fenced example sends portrait and audio references to PixVerse through belt. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The fenced example invokes a hosted video upscaler through belt. It causes external command, network, and potential billing side effects.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The fenced example sends a video to a hosted foley model through belt. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans prose headings. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The fenced example sends two videos to the hosted media merger through belt. It performs external command and network activity.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The match begins at a Markdown fence terminator and spans a section heading. It is not shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"This fenced block contains nine npx installation commands for external skills. Executing them introduces third-party package and supply-chain risk.","verdict":"confirmed","severity":"medium","confidence":0.99},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The detected span includes the direct instruction to run belt app list. This invokes the external CLI and platform.","verdict":"confirmed","severity":"medium","confidence":0.95},{"id":"network:SKILL.md:11:hardcoded-url","reason":"This is a normal informational hyperlink to the named service. It does not automatically send data or make a request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The Markdown image embeds a remote inference.sh cloud asset. Rendering it causes a request to an external host and can disclose request metadata.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"network:SKILL.md:17:hardcoded-url","reason":"This is a visible GitHub installation-document link, not an automatic fetch or hidden endpoint.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:110:hardcoded-url","reason":"The value is an obvious placeholder for user-provided media, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:118:hardcoded-url","reason":"The portrait URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:119:hardcoded-url","reason":"The audio URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:127:hardcoded-url","reason":"The face image URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:128:hardcoded-url","reason":"The audio URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:146:hardcoded-url","reason":"The image URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:157:hardcoded-url","reason":"The reference image URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:176:hardcoded-url","reason":"The video URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:185:hardcoded-url","reason":"The portrait URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:186:hardcoded-url","reason":"The audio URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:193:hardcoded-url","reason":"The https ellipsis is a placeholder within a documented command, not a usable hardcoded endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:200:hardcoded-url","reason":"The silent video URL is an obvious example placeholder, not a real hardcoded destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:209:hardcoded-url","reason":"Both clip URLs are obvious example placeholders, not real hardcoded destinations.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:249:hardcoded-url","reason":"This is a visible documentation hyperlink for the named service. It does not automatically make a request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:250:hardcoded-url","reason":"This is a visible documentation hyperlink for the named service. It does not automatically make a request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:251:hardcoded-url","reason":"This is a visible documentation hyperlink for the named service. It does not automatically make a request.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"External Processing of Sensitive Media","severity":"medium","locations":[{"file":"SKILL.md","line_end":121,"line_start":108},{"file":"SKILL.md","line_end":203,"line_start":174}],"confidence":0.98,"description":"The examples submit portrait, audio, and video references to hosted inference services. Users may expose personal, biometric, copyrighted, or confidential media.","confidence_reasoning":"The cited belt examples explicitly pass remote portrait, audio, and video URLs to hosted model applications."}],"subject_marketplace_commit_sha":"4121de961d1b6f2ffca856260e239505c302452c","subject_content_hash":"936b3fc40a465d49fcee14a1d1f21486e07caf1e4cb873d6e6b38f8939ca334f","subject_tree_hash":"6ff6ed94f18f8582cacfb9c699a6aa7e0de770ca8d98cf92d388d2a9a0b258ea","subject_plugin_path":"skills/infsh-skills/ai-video-generation","audit_payload_hash":"e79bbdbe51773c90d46c3e99c18a8aa0","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"4121de961d1b6f2ffca856260e239505c302452c","contentHash":"936b3fc40a465d49fcee14a1d1f21486e07caf1e4cb873d6e6b38f8939ca334f","treeHash":"6ff6ed94f18f8582cacfb9c699a6aa7e0de770ca8d98cf92d388d2a9a0b258ea","pluginPath":"skills/infsh-skills/ai-video-generation","auditPayloadHash":"e79bbdbe51773c90d46c3e99c18a8aa0"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/infsh-skills-ai-video-generation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":20,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}