Audit History

Version	Date	Result	Review items	Change vs previous
v5 Latest	12. Juli 2026, 10:19	1 confirmed	9	No capability change
v4	12. Juli 2026, 10:19	1 confirmed	9	No capability change
v3	8. Juli 2026, 14:11	1 confirmed	11	No capability change
v2	9. Juli 2026, 11:46	2 confirmed	11	No capability change
v1	8. Juli 2026, 14:11	1 confirmed	11	Baseline

12. Juli 2026, 10:19

Eight findings confirm commands that authenticate, submit rendering jobs, or install remote skill packages. One network finding confirms a remote image request; remaining matches are Markdown syntax, source examples, or documentation links. The workflows also send TSX and props to inference.sh for cloud execution.

1

Files scanned

213

Lines analyzed

12

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:23-29 SKILL.md:138-167

Cloud Code and Data Transmission

The documented workflows submit user-authored TSX, props, and render settings to the infsh/remotion-render cloud application. Sensitive content could leave the local environment.

Both CLI and Python examples explicitly pass component code and render inputs to a named cloud application.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Line 7 instructs users to run npx to download and install a remote skill package. This creates an external command and software supply-chain boundary.

Medium

SKILL.md:19-30 SKILL.md:72-80 SKILL.md:84-92 SKILL.md:96-98 SKILL.md:108-117 SKILL.md:121-129 SKILL.md:190-205

Ruby/shell backtick execution · 7 occurrences

```bash

The fenced block runs belt login and submits TSX to the remote remotion-render application. These are intentional external commands with authentication and network effects.

Low

SKILL.md:13

Hardcoded URL

![Remotion Render](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243m

The Markdown embeds an image from cloud.inference.sh, causing renderers to request a third-party asset. That request can expose client metadata to the host.

Audited by: codex

Audit version 4

12. Juli 2026, 10:19

Acht Befunde bestätigen Befehle, die eine Authentifizierung durchführen, Rendering-Aufträge übermitteln oder Remote-Skill-Pakete installieren. Ein Netzwerkbefund bestätigt eine Remote-Bildanfrage; bei den übrigen Treffern handelt es sich um Markdown-Syntax, Quellcodebeispiele oder Dokumentationslinks. Die Workflows senden außerdem TSX und Props zur Cloud-Ausführung an inference.sh.

1

Files scanned

213

Lines analyzed

12

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:23-29 SKILL.md:138-167

Übertragung von Code und Daten an die Cloud

Die dokumentierten Workflows übermitteln vom Benutzer erstelltes TSX, Props und Rendering-Einstellungen an die Cloud-Anwendung infsh/remotion-render. Vertrauliche Inhalte könnten die lokale Umgebung verlassen.

Sowohl die CLI- als auch die Python-Beispiele übergeben Komponentencode und Rendering-Eingaben ausdrücklich an eine benannte Cloud-Anwendung.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7

Ruby-/Shell-Ausführung mit Backticks

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Zeile 7 weist Benutzer an, npx auszuführen, um ein Remote-Skill-Paket herunterzuladen und zu installieren. Dadurch entsteht eine Vertrauensgrenze für externe Befehle und die Software-Lieferkette.

Medium

SKILL.md:19-30 SKILL.md:72-80 SKILL.md:84-92 SKILL.md:96-98 SKILL.md:108-117 SKILL.md:121-129 SKILL.md:190-205

Ruby/shell backtick execution · 7 occurrences

```bash

The fenced block runs belt login and submits TSX to the remote remotion-render application. These are intentional external commands with authentication and network effects.

Low

SKILL.md:13

Fest codierte URL

![Remotion Render](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243m

Das Markdown bindet ein Bild von cloud.inference.sh ein, wodurch Renderer ein Drittanbieter-Asset anfordern. Diese Anfrage kann Client-Metadaten gegenüber dem Host offenlegen.

Audited by: codex

Audit version 3

8. Juli 2026, 14:11

Most shell findings are Markdown backticks, tables, or code fences rather than Ruby shell execution. Several examples do instruct users to run belt or npx commands, and the core workflow sends user-provided TSX to inference.sh for remote rendering. No prompt injection text was found in SKILL.md.

1

Files scanned

213

Lines analyzed

14

Review items

0

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:23-29 SKILL.md:37

Remote Code And Data Submission

The quick start sends user-provided Remotion TSX as the code input to infsh/remotion-render through belt. This can expose proprietary component code, props, and media references to inference.sh.

The examples and input schema directly show a required code field sent through the external belt app. This confirms intended third-party processing, not local-only rendering.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line instructs users to run npx to install another CLI skill from outside this skill. That is a real external command and supply-chain risk, even though it appears as Markdown inline code.

Medium

SKILL.md:19-30 SKILL.md:72-80 SKILL.md:84-92 SKILL.md:96-98 SKILL.md:108-117 SKILL.md:121-129 SKILL.md:190-205

Ruby/shell backtick execution · 7 occurrences

```bash

The quick start block includes belt login and belt app run commands that submit TSX code to a remote renderer. This is intentional functionality, but it is real external command execution.

Low

SKILL.md:11

Hardcoded URL

Render videos from React/Remotion component code via [inference.sh](https://inference.sh) CLI.

This line identifies inference.sh as the external service used by the skill. The later render examples send user code to that service, so the network dependency is real.

Low

SKILL.md:13

Hardcoded URL

![Remotion Render](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243m

The Markdown image is hosted on cloud.inference.sh and can trigger an external fetch when rendered. This is low severity but a real hardcoded external content dependency.

Low

SKILL.md:17

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The required CLI installation instructions are loaded from a hardcoded raw.githubusercontent.com URL. That creates a low severity external supply-chain dependency.

Audited by: codex

Audit version 2

9. Juli 2026, 11:46

Most Ruby or shell backtick alerts are false positives from Markdown code fences, table field names, and TSX template literals. The actionable risks are the skill dependency on external CLI commands and the required use of inference.sh, which sends code and props to a remote service. No prompt injection text was found in SKILL.md.

1

Files scanned

213

Lines analyzed

15

Review items

0

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:4

Broad belt CLI Permission

The skill allows Bash(belt *), which permits any belt subcommand rather than only the remotion-render app command.

The frontmatter explicitly grants a wildcard belt permission. This is broader than the documented render workflow and increases the command surface.

Medium

SKILL.md:23-24 SKILL.md:37

Remote Execution of User-Provided TSX

The examples send a required TSX code string to infsh/remotion-render, so component code and props are processed by a remote renderer.

The documentation shows belt app run with a code payload and states that the code parameter is required. The behavior is intentional, but it creates data exposure and remote execution risk.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line instructs users to run npx to install an external CLI skill. Installing executable tooling from a community source is a real command execution risk.

Medium

SKILL.md:19-30 SKILL.md:72-80 SKILL.md:84-92 SKILL.md:96-98 SKILL.md:108-117 SKILL.md:121-129 SKILL.md:190-205

Ruby/shell backtick execution · 7 occurrences

```bash

The fenced example includes belt login and belt app run commands that execute an external CLI. These commands authenticate and send rendering input to a remote service.

Low

SKILL.md:11

Hardcoded URL

Render videos from React/Remotion component code via [inference.sh](https://inference.sh) CLI.

The line declares that rendering is performed through inference.sh. This confirms the skill depends on a third-party network service for core functionality.

Low

SKILL.md:13

Hardcoded URL

![Remotion Render](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243m

The Markdown image is loaded from a remote inference.sh URL. This can trigger an external request when the documentation is rendered.

Low

SKILL.md:17

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The install instructions link points to mutable raw GitHub content for the required CLI. Users may rely on external installation guidance outside this skill package.

Audited by: codex

Audit version 1

8. Juli 2026, 14:11

Most shell findings are Markdown backticks, tables, or code fences rather than Ruby shell execution. Several examples do instruct users to run belt or npx commands, and the core workflow sends user-provided TSX to inference.sh for remote rendering. No prompt injection text was found in SKILL.md.

1

Files scanned

213

Lines analyzed

14

Review items

0

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:23-29 SKILL.md:37

Remote Code And Data Submission

The quick start sends user-provided Remotion TSX as the code input to infsh/remotion-render through belt. This can expose proprietary component code, props, and media references to inference.sh.

The examples and input schema directly show a required code field sent through the external belt app. This confirms intended third-party processing, not local-only rendering.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line instructs users to run npx to install another CLI skill from outside this skill. That is a real external command and supply-chain risk, even though it appears as Markdown inline code.

Medium

SKILL.md:19-30 SKILL.md:72-80 SKILL.md:84-92 SKILL.md:96-98 SKILL.md:108-117 SKILL.md:121-129 SKILL.md:190-205

Ruby/shell backtick execution · 7 occurrences

```bash

The quick start block includes belt login and belt app run commands that submit TSX code to a remote renderer. This is intentional functionality, but it is real external command execution.

Low

SKILL.md:11

Hardcoded URL

Render videos from React/Remotion component code via [inference.sh](https://inference.sh) CLI.

This line identifies inference.sh as the external service used by the skill. The later render examples send user code to that service, so the network dependency is real.

Low

SKILL.md:13

Hardcoded URL

![Remotion Render](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg2c0egyg243m

The Markdown image is hosted on cloud.inference.sh and can trigger an external fetch when rendered. This is low severity but a real hardcoded external content dependency.

Low

SKILL.md:17

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The required CLI installation instructions are loaded from a hardcoded raw.githubusercontent.com URL. That creates a low severity external supply-chain dependency.

Audited by: codex

Version comparison

Confirmed security concerns (1)

Risk Factors

Confirmed security concerns (1)

Risk Factors

Confirmed security concerns (1)

Risk Factors

Confirmed security concerns (2)

Risk Factors

Confirmed security concerns (1)

Risk Factors