{"data":{"skill":{"slug":"skills-shell-ai-video-generation","name":"ai-video-generation","icon":"📦","repo":"https://github.com/skills-shell/skills/tree/main/tools/video/ai-video-generation/","status":"approved","author":"skills-shell","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"53120a09-1ef8-4b72-9310-09b241ef9016","skill_id":"0dfaf207-68fc-4c32-8c56-1d2d0a88fb2e","version":5,"content_hash":"v3:f93e9bb0daca99badb6a7e574b97737155d57cb3:79b7d8b8dc8724c60e9d7ba5168f9789515a23f3ef6a40d818b274308eb33efa:1a45b2d19b49fb8127e32cc0c7c446f3ebf93d181167e080fdd60dd8407e932a:736b696c6c732f736b696c6c732d7368656c6c2f61692d766964656f2d67656e65726174696f6e:0dc19b625627b2347b700f30b3b0c551","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The static backtick detections are false positives caused by Markdown code fences, inline commands, and model identifiers. No Ruby or shell command-substitution source is present. The real risks are external CLI dependency and hosted video processing of prompts, media URLs, likenesses, and voices.","remediation":[{"issue":"External CLI dependency is required for core use.","severity":"medium","suggestion":"Document the exact trusted install source, version expectations, and verification steps for the belt CLI before users run commands."},{"issue":"Prompts and media URLs may leave the user workspace.","severity":"medium","suggestion":"Add explicit privacy warnings before examples that submit images, voices, likenesses, videos, or confidential prompts to hosted models."},{"issue":"Generation commands may consume paid service credits.","severity":"medium","suggestion":"Require user confirmation for model, duration, resolution, and cost-sensitive options before running belt app commands."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":33,"line_start":24},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":49,"line_start":43},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":53,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":53},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":63,"line_start":62},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":71,"line_start":65},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":78},{"file":"SKILL.md","line_end":83,"line_start":79},{"file":"SKILL.md","line_end":85,"line_start":83},{"file":"SKILL.md","line_end":91,"line_start":85},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":99,"line_start":95},{"file":"SKILL.md","line_end":104,"line_start":99},{"file":"SKILL.md","line_end":108,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":108},{"file":"SKILL.md","line_end":116,"line_start":112},{"file":"SKILL.md","line_end":121,"line_start":116},{"file":"SKILL.md","line_end":125,"line_start":121},{"file":"SKILL.md","line_end":130,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":130},{"file":"SKILL.md","line_end":140,"line_start":134},{"file":"SKILL.md","line_end":144,"line_start":140},{"file":"SKILL.md","line_end":150,"line_start":144},{"file":"SKILL.md","line_end":154,"line_start":150},{"file":"SKILL.md","line_end":160,"line_start":154},{"file":"SKILL.md","line_end":164,"line_start":160},{"file":"SKILL.md","line_end":170,"line_start":164},{"file":"SKILL.md","line_end":174,"line_start":170},{"file":"SKILL.md","line_end":179,"line_start":174},{"file":"SKILL.md","line_end":183,"line_start":179},{"file":"SKILL.md","line_end":188,"line_start":183},{"file":"SKILL.md","line_end":192,"line_start":188},{"file":"SKILL.md","line_end":194,"line_start":192},{"file":"SKILL.md","line_end":198,"line_start":194},{"file":"SKILL.md","line_end":203,"line_start":198},{"file":"SKILL.md","line_end":207,"line_start":203},{"file":"SKILL.md","line_end":212,"line_start":207},{"file":"SKILL.md","line_end":216,"line_start":212},{"file":"SKILL.md","line_end":243,"line_start":216},{"file":"SKILL.md","line_end":245,"line_start":243}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":118,"line_start":118},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":157,"line_start":157},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":186,"line_start":186},{"file":"SKILL.md","line_end":193,"line_start":193},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":209,"line_start":209},{"file":"SKILL.md","line_end":249,"line_start":249},{"file":"SKILL.md","line_end":250,"line_start":250},{"file":"SKILL.md","line_end":251,"line_start":251}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Unverified Third-Party CLI Dependency","locations":[{"file":"SKILL.md","line_end":17,"line_start":7}],"confidence":0.86,"description":"The skill directs users to install the belt CLI skill and follow remote install instructions before use. A community skill depending on an external CLI and remote setup path creates supply-chain exposure.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"SKILL.md explicitly instructs users to install the belt CLI skill and links to remote installation instructions. This is a clear dependency risk, although no malicious install behavior is shown in this file."},{"title":"User Media Sent to External AI Services","locations":[{"file":"SKILL.md","line_end":24,"line_start":11},{"file":"SKILL.md","line_end":129,"line_start":108},{"file":"SKILL.md","line_end":200,"line_start":174}],"confidence":0.9,"description":"The skill runs hosted video models through belt and includes examples that pass image, audio, reference, and video URLs. Users may expose private prompts, likenesses, voices, or unreleased media to third-party processors.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The file describes inference.sh CLI use and shows commands with image_url, audio_url, video, and video_url inputs. The risk is inherent to the documented hosted AI workflow, not hidden behavior."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":253,"audit_model":"codex","audited_at":"2026-07-07T05:58:13.475+00:00","created_at":"2026-07-16T03:03:57.995451+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":33,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 Fast | `google/veo-3-1-fast` | Fast, with optional audio |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3.1 | `google/veo-3-1` | Best quality, frame interpolation |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 | `google/veo-3` | High quality with audio |","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 3 Fast | `google/veo-3-fast` | Fast with audio |","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Veo 2 | `google/veo-2` | Realistic videos |","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast, economical, with audio support |","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-T2V** | `pruna/wan-t2v` | Economical 480p/720p |","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Grok Video | `xai/grok-imagine-video` | xAI, configurable duration |","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Text/image/ref-to-video with sync audio, up to 1080p","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse T2V** | `alibaba/happyhorse-1-0-t2v` | Physically realistic, up to 15s |","category":"external_commands","line_end":49,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 | `falai/wan-2-5` | Animate any image |","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Wan 2.5 I2V | `falai/wan-2-5-i2v` | High quality i2v |","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **WAN-I2V** | `pruna/wan-i2v` | Economical 480p/720p |","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Video** | `pruna/p-video` | Fast i2v with audio |","category":"external_commands","line_end":53,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0** | `bytedance/seedance-2-0` | Animate images with sync audio, up to 1080p |","category":"external_commands","line_end":54,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Seedance 2.0 Fast** | `bytedance/seedance-2-0-fast` | Fast variant, same capabilities |","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse I2V** | `alibaba/happyhorse-1-0-i2v` | Animate images, up to 1080P/15s |","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **HappyHorse R2V** | `alibaba/happyhorse-1-0-r2v` | Character-preserving from references |","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.5 | `bytedance/omnihuman-1-5` | Multi-character |","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| OmniHuman 1.0 | `bytedance/omnihuman-1-0` | Single character |","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Fabric 1.0 | `falai/fabric-1-0` | Image talks with lipsync |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| PixVerse Lipsync | `falai/pixverse-lipsync` | Realistic lipsync |","category":"external_commands","line_end":71,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HappyHorse Edit | `alibaba/happyhorse-1-0-video-edit` | Natural language video editing |","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| HunyuanVideo Foley | `infsh/hunyuanvideo-foley` | Add sound effects to video |","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Topaz Upscaler | `falai/topaz-video-upscaler` | Upscale video quality |","category":"external_commands","line_end":79,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Media Merger | `infsh/media-merger` | Merge videos with transitions |","category":"external_commands","line_end":83,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":91,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":104,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":112,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":121,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":130,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":134,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":140,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":144,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":150,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":154,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":160,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":170,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":179,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":183,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":188,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":192,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":194,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":198,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":203,"severity":"medium","line_start":198},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":207,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":212,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":212},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":243,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":245,"severity":"medium","line_start":243},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Generate videos with 40+ AI models via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![AI Video Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:110:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://your-image.jpg\"","category":"network","line_end":110,"severity":"low","line_start":110},{"id":"network:SKILL.md:118:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":118,"severity":"low","line_start":118},{"id":"network:SKILL.md:119:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":119,"severity":"low","line_start":119},{"id":"network:SKILL.md:127:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://face.jpg\",","category":"network","line_end":127,"severity":"low","line_start":127},{"id":"network:SKILL.md:128:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://audio.mp3\"","category":"network","line_end":128,"severity":"low","line_start":128},{"id":"network:SKILL.md:146:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image\": \"https://your-image.jpg\",","category":"network","line_end":146,"severity":"low","line_start":146},{"id":"network:SKILL.md:157:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"reference_image\": \"https://portrait.jpg\",","category":"network","line_end":157,"severity":"low","line_start":157},{"id":"network:SKILL.md:176:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://your-video.mp4\",","category":"network","line_end":176,"severity":"low","line_start":176},{"id":"network:SKILL.md:185:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://portrait.jpg\",","category":"network","line_end":185,"severity":"low","line_start":185},{"id":"network:SKILL.md:186:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://speech.mp3\"","category":"network","line_end":186,"severity":"low","line_start":186},{"id":"network:SKILL.md:193:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"belt app run falai/topaz-video-upscaler --input '{\"video_url\": \"https://...\"}'","category":"network","line_end":193,"severity":"low","line_start":193},{"id":"network:SKILL.md:200:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://silent-video.mp4\",","category":"network","line_end":200,"severity":"low","line_start":200},{"id":"network:SKILL.md:209:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"videos\": [\"https://clip1.mp4\", \"https://clip2.mp4\"],","category":"network","line_end":209,"severity":"low","line_start":209},{"id":"network:SKILL.md:249:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":249,"severity":"low","line_start":249},{"id":"network:SKILL.md:250:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Streaming Results](https://inference.sh/docs/api/sdk/streaming) - Real-time progress updates","category":"network","line_end":250,"severity":"low","line_start":250},{"id":"network:SKILL.md:251:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Content Pipeline Example](https://inference.sh/docs/examples/content-pipeline) - Building media w","category":"network","line_end":251,"severity":"low","line_start":251}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:198:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:212:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown inline code, fenced examples, or model identifiers in SKILL.md. They are not Ruby or shell command substitution executed by the skill.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:11:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:110:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:118:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:119:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:127:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:128:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:146:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:157:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:176:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:185:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:186:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:193:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:200:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:209:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:249:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:250:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:251:hardcoded-url","reason":"The URL appears in documentation, a linked image, or an example user-supplied media input. It is not a hidden network request in executable code; the external service privacy risk is tracked separately.","verdict":"false_positive","confidence":0.88}],"semantic_findings":[{"title":"Unverified Third-Party CLI Dependency","severity":"medium","locations":[{"file":"SKILL.md","line_end":17,"line_start":7}],"confidence":0.86,"description":"The skill directs users to install the belt CLI skill and follow remote install instructions before use. A community skill depending on an external CLI and remote setup path creates supply-chain exposure.","confidence_reasoning":"SKILL.md explicitly instructs users to install the belt CLI skill and links to remote installation instructions. This is a clear dependency risk, although no malicious install behavior is shown in this file."},{"title":"User Media Sent to External AI Services","severity":"medium","locations":[{"file":"SKILL.md","line_end":24,"line_start":11},{"file":"SKILL.md","line_end":129,"line_start":108},{"file":"SKILL.md","line_end":200,"line_start":174}],"confidence":0.9,"description":"The skill runs hosted video models through belt and includes examples that pass image, audio, reference, and video URLs. Users may expose private prompts, likenesses, voices, or unreleased media to third-party processors.","confidence_reasoning":"The file describes inference.sh CLI use and shows commands with image_url, audio_url, video, and video_url inputs. The risk is inherent to the documented hosted AI workflow, not hidden behavior."}],"subject_marketplace_commit_sha":"f93e9bb0daca99badb6a7e574b97737155d57cb3","subject_content_hash":"79b7d8b8dc8724c60e9d7ba5168f9789515a23f3ef6a40d818b274308eb33efa","subject_tree_hash":"1a45b2d19b49fb8127e32cc0c7c446f3ebf93d181167e080fdd60dd8407e932a","subject_plugin_path":"skills/skills-shell/ai-video-generation","audit_payload_hash":"0dc19b625627b2347b700f30b3b0c551","confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":"f93e9bb0daca99badb6a7e574b97737155d57cb3","contentHash":"79b7d8b8dc8724c60e9d7ba5168f9789515a23f3ef6a40d818b274308eb33efa","treeHash":"1a45b2d19b49fb8127e32cc0c7c446f3ebf93d181167e080fdd60dd8407e932a","pluginPath":"skills/skills-shell/ai-video-generation","auditPayloadHash":"0dc19b625627b2347b700f30b3b0c551"},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":true}}