Most static command hits are Markdown fences, inline CLI names, or documentation examples rather than dynamic shell execution. Confirmed risks are limited to third-party CLI installation guidance, belt commands that call external generation services, and remote processing of prompts or app imagery.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line recommends running npx to install a third-party CLI skill. That can download and execute external package code during setup, so it is a real supply-chain risk.
The fenced example runs belt login and belt app run against a remote model service. The arguments are static, but execution requires authentication and sends prompt data to an external CLI.
The example invokes belt app run to submit a prompt to a third-party image generation model. It is intentional functionality, but still external command and network execution.
The example invokes belt app run for remote image generation. It is a legitimate workflow, but it can transmit user prompt details to the external provider.
The example runs belt app run with local image filenames for stitching. If executed, app screenshots may be read or uploaded by the external CLI workflow.
The example invokes belt app run against a remote video generation model. It is legitimate for the skill, but it is still external command execution with network transfer.
The line links to mutable raw GitHub install instructions for a required external CLI. This is a low-severity supply-chain concern because users may follow unaudited setup content.
The skill directs users to create screenshots and videos through the inference.sh belt CLI. Prompts and referenced app images may be processed by an external service, so private app assets need explicit user approval.
The documentation explicitly depends on inference.sh and shows belt app run commands for remote image, stitching, and video generation. The risk is privacy exposure, not evidence of malicious intent.
04
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
FIX-001
中
External CLI and skill installation commands
Move npx installation steps behind explicit user confirmation and pin trusted sources or versions where possible.
FIX-002
中
Remote processing of app prompts and images
Add a privacy note telling users not to submit confidential screenshots, unreleased UI, credentials, or customer data without approval.
FIX-003
低
Mutable external install documentation link
Prefer stable release documentation or a pinned commit URL for installation instructions.