{"data":{"skill":{"slug":"skills-shell-ai-image-generation","name":"ai-image-generation","icon":"📦","repo":"https://github.com/skills-shell/skills/tree/main/tools/image/ai-image-generation/","status":"approved","author":"skills-shell","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"9e699205-a024-45f6-9ef5-5b404b7a0e97","skill_id":"e5d7afbc-105a-4084-9b03-4a8bf9828bda","version":1,"content_hash":"1a7b1f60c0776c3b2b270e5fb66f7a2f","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All 55 static analysis findings are false positives. The skill is a Markdown documentation file that shows CLI usage examples for the inference.sh belt tool. Backtick patterns flagged as shell execution are actually Markdown code blocks within fenced code blocks. The flagged URLs are legitimate documentation and placeholder example links. No malicious intent or dangerous code patterns were found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":31,"line_start":24},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":58,"line_start":52},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":67,"line_start":63},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":76,"line_start":72},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":84,"line_start":80},{"file":"SKILL.md","line_end":86,"line_start":84},{"file":"SKILL.md","line_end":90,"line_start":86},{"file":"SKILL.md","line_end":94,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":111,"line_start":107},{"file":"SKILL.md","line_end":115,"line_start":111},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":129,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":129},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":162,"line_start":138},{"file":"SKILL.md","line_end":164,"line_start":162}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":170,"line_start":170}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Markdown code blocks flagged as shell backtick execution","locations":[{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":72,"line_start":67}],"confidence":0.98,"description":"Static analyzer flagged 44 Markdown fenced code blocks as Ruby/shell backtick execution. All instances are within ```bash code fences showing CLI usage examples. No actual command execution occurs in the Markdown file. The skill does require Bash access via the allowed-tools directive, but the flagged patterns are documentation, not exploits.","confidence_reasoning":"All flagged lines are standard Markdown fenced code blocks. The static analyzer incorrectly interpreted backtick code fences as Ruby shell backtick execution."},{"title":"Documentation URLs flagged as hardcoded network endpoints","locations":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":170,"line_start":168}],"confidence":0.95,"description":"Static analyzer flagged 10 URLs as hardcoded network references. All URLs point to legitimate documentation (inference.sh), GitHub installation instructions, or are placeholder examples (https://your-image.jpg, https://img1.jpg). No data exfiltration or malicious endpoints.","confidence_reasoning":"All URLs resolve to the legitimate inference.sh domain or are clearly placeholder examples. No suspicious domains or encoded payloads detected."},{"title":"Weak cryptographic algorithm detection is false positive","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.99,"description":"Static analyzer flagged line 3 for a weak cryptographic algorithm. Line 3 is the YAML front matter description listing model names including Seedream and Gemini. No cryptographic algorithms or operations are present anywhere in the file.","confidence_reasoning":"The description field contains model names, not cryptographic algorithms. No crypto-related code exists in the file."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":172,"audit_model":"claude","audited_at":"2026-05-21T09:19:23.548+00:00","created_at":"2026-05-21T10:00:32.092549+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}