The skill is a legitimate image-to-video guide, but several examples run belt commands that contact third-party inference services and upload local media. Most backtick and reconnaissance static hits are markdown formatting or model names, while actual belt and npx command examples remain confirmed medium risk.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 recommends running npx to install an external CLI skill. This is intentional setup guidance, but it asks users to execute third-party package code.
Lines 108-139 provide multiple belt app run commands for remote image-to-video generation. These are legitimate examples but still execute external CLI workflows.
Lines 154-170 contain belt commands that start remote jobs and merge media. These examples intentionally invoke external services and process user media.
Lines 176-205 define a full belt pipeline for image generation, animation, upscaling, audio, and media merging. The pipeline executes external commands against remote apps.
Lines 215-220 include a belt app run command for remote image-to-video generation. This is intended use, but it can submit local media to an external service.
Convert still images to animated videos via [inference.sh](https://inference.sh) CLI.
Line 11 links to inference.sh, the external service used by the workflow. The URL is disclosed, but it confirms the skill depends on a third-party network service.
The skill instructs belt app runs that submit image, video, and audio paths to remote inference apps. Sensitive media could be exposed if users run these examples without consent checks.
Multiple documented belt app run examples include local media path fields passed to remote model apps. This is clear external processing, although it appears disclosed and task-related.
04
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
FIX-001
中
External command examples run third-party CLI workflows.
Require explicit user confirmation before running belt commands, especially commands that upload local images, video, or audio.
FIX-002
中
Media privacy expectations are not stated before upload examples.
Add a clear warning that belt app runs may send media to inference.sh and model providers. Recommend sanitized or approved assets.
FIX-003
低
npx installation guidance depends on external packages and skills.
Pin trusted sources or direct users to verified installation documentation before suggesting npx skill installation commands.