{"data":{"skill":{"slug":"skills-shell-ai-image-generation","name":"ai-image-generation","icon":"📦","repo":"https://github.com/skills-shell/skills/tree/main/tools/image/ai-image-generation/","status":"approved","author":"skills-shell","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"7b7eafd9-f94e-4d38-b169-0fcef9c6ed86","skill_id":"e5d7afbc-105a-4084-9b03-4a8bf9828bda","version":2,"content_hash":"d2cabe8e3111c39b67c3a9f7a983f7c4","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged many external command and URL patterns plus one weak-cryptography pattern. Review found the command findings are mostly Markdown examples for the expected belt CLI workflow, and the weak-cryptography finding at SKILL.md line 3 appears to be a false positive with no cryptographic code present. The skill still carries medium risk because it instructs agents to run a networked CLI that sends prompts and image URLs to third-party inference services.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":86,"line_start":84},{"file":"SKILL.md","line_end":94,"line_start":90},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":111,"line_start":107},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":134,"line_start":129},{"file":"SKILL.md","line_end":162,"line_start":138},{"file":"SKILL.md","line_end":164,"line_start":164}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":170,"line_start":170}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Networked CLI Sends Prompts and Image URLs to External Services","locations":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":131,"line_start":123}],"confidence":0.86,"description":"The skill is designed around belt app run commands that call hosted inference.sh apps. This is legitimate for image generation, but user prompts and image URLs may be transmitted to third-party model providers, so users should avoid secrets, private images, and confidential brand assets unless policy permits it.","confidence_reasoning":"The documented commands invoke remote inference apps and include examples that pass prompts and image URLs. No malicious exfiltration intent was found, but external data transfer is central to the workflow."},{"title":"Supply Chain Exposure From Skill Installation Commands","locations":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":162,"line_start":138}],"confidence":0.74,"description":"The documentation recommends installing CLI and related skills with npx skills add commands. This can be normal setup, but it introduces trust risk because users may fetch executable tooling or additional community skills from external repositories.","confidence_reasoning":"The installation commands are explicit and external. They appear related to the skill purpose, but users should review source and package provenance before running them."}],"low_findings":[{"title":"Static Backtick Execution Findings Are Markdown False Positives","locations":[{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":46,"line_start":31},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":162,"line_start":138}],"confidence":0.93,"description":"The analyzer reported many Ruby or shell backtick execution findings, but the reviewed locations are Markdown inline code, command examples, or code fences. They are not executable code inside the skill file, although the commands may be run by an agent when the user requests image generation.","confidence_reasoning":"The file is Markdown documentation, and the flagged backticks are formatting delimiters or examples. There is no Ruby source or automatic command execution in the reviewed content."},{"title":"Weak Cryptography Finding Is Not Supported by File Context","locations":[{"file":"SKILL.md","line_end":3,"line_start":3}],"confidence":0.96,"description":"The analyzer flagged SKILL.md line 3 for weak cryptography, but that line is frontmatter describing image models and trigger phrases. No evidence of cryptographic code, hashing, encryption, or credential handling was found at that location.","confidence_reasoning":"Line 3 contains descriptive metadata only. The weak cryptography classification does not match the observed content."},{"title":"Hardcoded URLs Are Documentation and Example Inputs","locations":[{"file":"SKILL.md","line_end":17,"line_start":11},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":131,"line_start":124},{"file":"SKILL.md","line_end":170,"line_start":168}],"confidence":0.88,"description":"The URLs point to inference.sh documentation, an image asset, install instructions, and placeholder image inputs. They do not show covert endpoints or automatic credential exfiltration, but they confirm that the skill depends on external network services.","confidence_reasoning":"The URLs are visible documentation links or sample image fields. No hidden data collection or suspicious destination was found in the reviewed file."}],"dangerous_patterns":[{"title":"Allowed Bash Access for belt Commands","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.9,"description":"The skill frontmatter allows Bash commands matching belt. This is necessary for the skill, but it permits networked external process execution through the belt CLI.","confidence_reasoning":"The allowed-tools entry is explicit and scoped to belt. The risk is clear but tied to the advertised functionality."},{"title":"Remote Image Generation Commands","locations":[{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":131,"line_start":123}],"confidence":0.87,"description":"The examples run remote model apps with user-provided prompts and optional image URLs. This can expose prompt text or image references to external services.","confidence_reasoning":"Multiple examples use belt app run against hosted model IDs. The reviewed content does not hide the network behavior."}],"files_scanned":1,"total_lines":172,"audit_model":"codex","audited_at":"2026-06-30T20:15:51.034+00:00","created_at":"2026-06-30T21:03:52.249374+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}