Several static detections are real low-to-medium risks because the skill asks users to install and run the third-party belt CLI. The remaining detections are Markdown fences, diagrams, or metadata false positives; no prompt injection or covert exfiltration intent was found.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The inline command asks users to run npx skills add belt-sh/cli, which installs an external skill through a package runner. It is not automatic execution, but it creates a real supply-chain risk if followed.
The quick-start bash block instructs belt login and belt app run, which launch a third-party CLI and remote model call. The command family is constrained, but it still executes external tooling.
The fenced bash example runs belt app run against a remote image model. It is legitimate screenshot generation, but it executes a third-party CLI and sends prompt data externally.
The fenced bash example calls belt app run for a remote image generation model. The usage is documented and bounded, but it still depends on external CLI execution.
The example runs belt app run to generate a lifestyle mockup through a remote service. It is expected behavior, but it can disclose prompt content to third parties.
The bash example runs belt app run infsh/stitch-images with local image filenames. This can upload or process local screenshot assets through an external CLI.
The preview video example runs belt app run against a remote video generation model. This is legitimate for the skill, but it executes external tooling and transmits prompt data.
The related skills block recommends npx skills add commands for external skill installation. These are manual commands, but they introduce supply-chain risk if executed.
The section includes a belt app store command after the fenced block. It is a documented CLI action, not automatic execution, but it invokes third-party tooling.
Create app store screenshots and preview videos via [inference.sh](https://inference.sh) CLI.
The skill explicitly depends on the inference.sh network service for screenshot and video generation. This is expected, but users should know prompt and asset data may leave their environment.
The install instructions use a raw GitHub URL from an external repository. It is a normal documentation link, but it is still a third-party network dependency.
03
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
この完了済み監査には、確認済みのセキュリティ検出事項は記録されていません。
04
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
FIX-001
中
External CLI execution and related skill installs
Require explicit user review before running belt or npx skills add commands, and pin trusted install sources where possible.
FIX-002
低
Remote inference data disclosure
Add a clear privacy note that prompts, screenshots, and generated assets may be sent to inference.sh or model providers.