{"data":{"skill":{"slug":"skillssh-ai-image-generation","name":"ai-image-generation","icon":"📦","repo":"https://github.com/skillssh/skills/tree/main/tools/image/ai-image-generation/","status":"approved","author":"skillssh","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"ab8c5dba-98cb-4f68-9c85-c69d86a5da6a","skill_id":"d267aba7-03b1-447d-8a75-4e7a5dfc487b","version":5,"content_hash":"v3:b1ef80115e869b66867d4eac8e3c8dc56a393a8d:93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e:2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca:736b696c6c732f736b696c6c7373682f61692d696d6167652d67656e65726174696f6e:8c59056d12bb78889ffccf3d64efc1ff","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 44 external-command alerts are false positives caused by Markdown code formatting, and eight URL alerts are documentation links or placeholders. The embedded remote image is a confirmed low-risk network request, while semantic review identified unpinned installation instructions and remote processing of prompts and images.","remediation":[{"issue":"The skill recommends unpinned third-party installations and mutable main-branch instructions.","severity":"high","suggestion":"Pin packages and skill references to reviewed versions or commits, provide integrity information, and explain the trust boundary before installation."},{"issue":"Generation and editing can transmit prompts and image references to external model services.","severity":"medium","suggestion":"Disclose remote processing and data retention terms, and require confirmation before sending sensitive or private material."},{"issue":"The skill embeds an externally hosted image that may load when the document renders.","severity":"low","suggestion":"Bundle the image locally or serve it through an approved marketplace asset proxy."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":24,"line_start":19},{"file":"SKILL.md","line_end":31,"line_start":24},{"file":"SKILL.md","line_end":32,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":33},{"file":"SKILL.md","line_end":35,"line_start":34},{"file":"SKILL.md","line_end":36,"line_start":35},{"file":"SKILL.md","line_end":37,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":37},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":39},{"file":"SKILL.md","line_end":41,"line_start":40},{"file":"SKILL.md","line_end":42,"line_start":41},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":50,"line_start":46},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":58,"line_start":52},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":67,"line_start":63},{"file":"SKILL.md","line_end":72,"line_start":67},{"file":"SKILL.md","line_end":76,"line_start":72},{"file":"SKILL.md","line_end":80,"line_start":76},{"file":"SKILL.md","line_end":84,"line_start":80},{"file":"SKILL.md","line_end":86,"line_start":84},{"file":"SKILL.md","line_end":90,"line_start":86},{"file":"SKILL.md","line_end":94,"line_start":90},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":103,"line_start":98},{"file":"SKILL.md","line_end":107,"line_start":103},{"file":"SKILL.md","line_end":111,"line_start":107},{"file":"SKILL.md","line_end":115,"line_start":111},{"file":"SKILL.md","line_end":119,"line_start":115},{"file":"SKILL.md","line_end":123,"line_start":119},{"file":"SKILL.md","line_end":125,"line_start":123},{"file":"SKILL.md","line_end":129,"line_start":125},{"file":"SKILL.md","line_end":134,"line_start":129},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":162,"line_start":138},{"file":"SKILL.md","line_end":164,"line_start":162}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":131,"line_start":131},{"file":"SKILL.md","line_end":168,"line_start":168},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":170,"line_start":170}]}],"critical_findings":[],"high_findings":[{"title":"Unpinned Third-Party Installation","locations":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":162,"line_start":138}],"confidence":0.95,"description":"The skill directs users to run \"npx skills add belt-sh/cli\" and follow mutable main-branch instructions. Unpinned third-party content can change after review and execute compromised code.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The cited lines explicitly recommend npx-based skill installation without versions or immutable commits, and the install guide references a mutable main branch."}],"medium_findings":[{"title":"External Processing of Prompts and Images","locations":[{"file":"SKILL.md","line_end":23,"line_start":20},{"file":"SKILL.md","line_end":71,"line_start":67},{"file":"SKILL.md","line_end":124,"line_start":123}],"confidence":0.93,"description":"The belt examples submit prompts and image URLs to hosted model applications. Sensitive text or images may leave the local environment without an explicit privacy warning.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The skill states that generation uses inference.sh and provides authenticated belt app commands containing prompts and remote image references."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":13,"line_start":13}],"confidence":0.92,"description":"![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The Markdown image embeds a remote cloud.inference.sh asset, so rendering can disclose network metadata to that host. No local-file disclosure or payload execution is shown."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":172,"audit_model":"codex","audited_at":"2026-09-07T15:35:47.039+00:00","created_at":"2026-09-07T17:18:31.571052+00:00","static_findings":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Install the belt CLI skill:** `npx skills add belt-sh/cli`","category":"external_commands","line_end":7,"severity":"medium","line_start":7},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":24,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **GPT-Image-2** | `openai/gpt-image-2` | Text-to-image, editing, inpainting |","category":"external_commands","line_end":32,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX Dev LoRA | `falai/flux-dev-lora` | High quality with custom styles |","category":"external_commands","line_end":33,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX.2 Klein LoRA | `falai/flux-2-klein-lora` | Fast with LoRA support (4B/9B) |","category":"external_commands","line_end":34,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image** | `pruna/p-image` | Fast, economical, multiple aspects |","category":"external_commands","line_end":35,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image-LoRA** | `pruna/p-image-lora` | Fast with preset LoRA styles |","category":"external_commands","line_end":36,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **P-Image-Edit** | `pruna/p-image-edit` | Fast image editing |","category":"external_commands","line_end":37,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Gemini 3 Pro | `google/gemini-3-pro-image-preview` | Google's latest |","category":"external_commands","line_end":38,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Gemini 2.5 Flash | `google/gemini-2-5-flash-image` | Fast Google model |","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Grok Imagine | `xai/grok-imagine-image` | xAI's model, multiple aspects |","category":"external_commands","line_end":40,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 4.5 | `bytedance/seedream-4-5` | 2K-4K cinematic quality |","category":"external_commands","line_end":41,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 4.0 | `bytedance/seedream-4-0` | High quality 2K-4K |","category":"external_commands","line_end":42,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Seedream 3.0 | `bytedance/seedream-3-0-t2i` | Accurate text rendering |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Reve | `falai/reve` | Natural language editing, text rendering |","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ImagineArt 1.5 Pro | `falai/imagine-art-1-5-pro-preview` | Ultra-high-fidelity 4K |","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| FLUX Klein 4B | `pruna/flux-klein-4b` | Ultra-cheap ($0.0001/image) |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Topaz Upscaler | `falai/topaz-image-upscaler` | Professional upscaling |","category":"external_commands","line_end":50,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":58,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":63,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":67,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":72,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":76,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":80,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":84,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":86,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":94,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":103,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":111,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":115,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":119,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":123,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":125,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":129,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":162,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":162},{"id":"network:SKILL.md:11:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Generate images with 50+ AI models via [inference.sh](https://inference.sh) CLI.","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:70:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"images\": [\"https://your-image.jpg\"]","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:SKILL.md:124:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"belt app run falai/topaz-image-upscaler --input '{\"image_url\": \"https://...\"}'","category":"network","line_end":124,"severity":"low","line_start":124},{"id":"network:SKILL.md:131:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"images\": [\"https://img1.jpg\", \"https://img2.jpg\"],","category":"network","line_end":131,"severity":"low","line_start":131},{"id":"network:SKILL.md:168:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Running Apps](https://inference.sh/docs/apps/running) - How to run apps via CLI","category":"network","line_end":168,"severity":"low","line_start":168},{"id":"network:SKILL.md:169:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Image Generation Example](https://inference.sh/docs/examples/image-generation) - Complete image g","category":"network","line_end":169,"severity":"low","line_start":169},{"id":"network:SKILL.md:170:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [Apps Overview](https://inference.sh/docs/apps/overview) - Understanding the app ecosystem","category":"network","line_end":170,"severity":"low","line_start":170}],"finding_verdicts":[{"id":"external_commands:SKILL.md:7:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"The detected backticks are Markdown inline-code or code-fence delimiters, not Ruby execution syntax. This finding does not establish runtime command execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:11:hardcoded-url","reason":"This is a visible documentation or installation link, not code that automatically performs a request. The URL alone provides no evidence of malicious network behavior.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The Markdown image embeds a remote cloud.inference.sh asset, so rendering can disclose network metadata to that host. No local-file disclosure or payload execution is shown.","verdict":"confirmed","severity":"low","confidence":0.92},{"id":"network:SKILL.md:17:hardcoded-url","reason":"This is a visible documentation or installation link, not code that automatically performs a request. The URL alone provides no evidence of malicious network behavior.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:70:hardcoded-url","reason":"This URL is a placeholder inside an example input, not a live destination or an automatic request. It provides no evidence of a hardcoded exfiltration endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:124:hardcoded-url","reason":"This URL is a placeholder inside an example input, not a live destination or an automatic request. It provides no evidence of a hardcoded exfiltration endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:131:hardcoded-url","reason":"This URL is a placeholder inside an example input, not a live destination or an automatic request. It provides no evidence of a hardcoded exfiltration endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:168:hardcoded-url","reason":"This is a visible documentation or installation link, not code that automatically performs a request. The URL alone provides no evidence of malicious network behavior.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:169:hardcoded-url","reason":"This is a visible documentation or installation link, not code that automatically performs a request. The URL alone provides no evidence of malicious network behavior.","verdict":"false_positive","confidence":0.97},{"id":"network:SKILL.md:170:hardcoded-url","reason":"This is a visible documentation or installation link, not code that automatically performs a request. The URL alone provides no evidence of malicious network behavior.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[{"title":"Unpinned Third-Party Installation","severity":"high","locations":[{"file":"SKILL.md","line_end":7,"line_start":7},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":162,"line_start":138}],"confidence":0.95,"description":"The skill directs users to run \"npx skills add belt-sh/cli\" and follow mutable main-branch instructions. Unpinned third-party content can change after review and execute compromised code.","confidence_reasoning":"The cited lines explicitly recommend npx-based skill installation without versions or immutable commits, and the install guide references a mutable main branch."},{"title":"External Processing of Prompts and Images","severity":"medium","locations":[{"file":"SKILL.md","line_end":23,"line_start":20},{"file":"SKILL.md","line_end":71,"line_start":67},{"file":"SKILL.md","line_end":124,"line_start":123}],"confidence":0.93,"description":"The belt examples submit prompts and image URLs to hosted model applications. Sensitive text or images may leave the local environment without an explicit privacy warning.","confidence_reasoning":"The skill states that generation uses inference.sh and provides authenticated belt app commands containing prompts and remote image references."}],"subject_marketplace_commit_sha":"b1ef80115e869b66867d4eac8e3c8dc56a393a8d","subject_content_hash":"93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e","subject_tree_hash":"2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca","subject_plugin_path":"skills/skillssh/ai-image-generation","audit_payload_hash":"8c59056d12bb78889ffccf3d64efc1ff","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"b1ef80115e869b66867d4eac8e3c8dc56a393a8d","contentHash":"93adf907089aacb9100f8b8e0f10f47778c6f69f6b05587ffb1cd754e8ad103e","treeHash":"2cb9ce991233bcec73fba893a5a640197340eaa3a255e3c3c81e31142d880fca","pluginPath":"skills/skillssh/ai-image-generation","auditPayloadHash":"8c59056d12bb78889ffccf3d64efc1ff"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/skillssh-ai-image-generation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}