All 44 external-command alerts are false positives caused by Markdown code formatting, and eight URL alerts are documentation links or placeholders. The embedded remote image is a confirmed low-risk network request, while semantic review identified unpinned installation instructions and remote processing of prompts and images.
The skill directs users to run "npx skills add belt-sh/cli" and follow mutable main-branch instructions. Unpinned third-party content can change after review and execute compromised code.
The cited lines explicitly recommend npx-based skill installation without versions or immutable commits, and the install guide references a mutable main branch.
The belt examples submit prompts and image URLs to hosted model applications. Sensitive text or images may leave the local environment without an explicit privacy warning.
The skill states that generation uses inference.sh and provides authenticated belt app commands containing prompts and remote image references.
The Markdown image embeds a remote cloud.inference.sh asset, so rendering can disclose network metadata to that host. No local-file disclosure or payload execution is shown.
Most static findings are false positives caused by Markdown inline code and fenced command examples being classified as Ruby backtick execution. One low network finding remains for mutable raw GitHub installation guidance, and one semantic medium finding covers the broad Bash(infsh *) permission for external image generation.
The skill front matter grants Bash(infsh *) access. This enables calls to the inference.sh CLI, which can send prompts, image URLs, and generated assets to an external service.
The allowed-tools declaration is explicit and directly enables external CLI use. The risk is contextual because the permission matches the skill purpose but still permits networked processing and possible account costs.
The install instructions link points to mutable raw GitHub content that users may rely on during setup. It is not an automatic network request, so the risk is limited.
Most static findings are false positives caused by Markdown inline code and fenced command examples being classified as Ruby backtick execution. One low network finding remains for mutable raw GitHub installation guidance, and one semantic medium finding covers the broad Bash(infsh *) permission for external image generation.
The skill front matter grants Bash(infsh *) access. This enables calls to the inference.sh CLI, which can send prompts, image URLs, and generated assets to an external service.
The allowed-tools declaration is explicit and directly enables external CLI use. The risk is contextual because the permission matches the skill purpose but still permits networked processing and possible account costs.
The install instructions link points to mutable raw GitHub content that users may rely on during setup. It is not an automatic network request, so the risk is limited.
Static analysis reported many external command hits and URL hits, but the Ruby backtick and weak cryptography findings are false positives from Markdown content. The skill intentionally uses the infsh CLI to call remote image-generation services, so the real risks are third-party network submission, account cost exposure, and handling of image URLs or prompts.
External CLI Sends Prompts and Image Data to Remote Services
The skill grants Bash access for infsh commands and documents infsh login plus app run calls. This is the intended function, but prompts, image URLs, and account activity are sent to inference.sh hosted model apps and may incur usage charges.
The Markdown explicitly allows Bash(infsh *) and shows infsh app run commands with prompt and image_url inputs. This confirms remote CLI use, but no malicious exfiltration intent was found.
Related Skill Installation Commands Require User Review
The related skills section contains npx skills add examples. The current skill only allows infsh Bash commands, but users should still review any additional skills before installing them.
The commands are documentation for related skills and are outside the declared Bash(infsh *) tool allowance. They can still affect a user environment if copied and executed manually.
The skill links to inference.sh documentation, a hosted preview image, and placeholder image URLs. These URLs are normal documentation and examples, with no evidence of hidden data exfiltration.
The URLs are visible links or placeholder inputs in documentation. They do not include secret values, encoded payloads, or suspicious destinations.
Weak Cryptography Finding Is Not Supported by File Context
The static analyzer flagged weak cryptography at the description line, but the line describes image models and use cases. No evidence found of hashing, encryption, or cryptographic code in the skill file.
Line 3 is front matter text about AI image generation models. The reviewed file contains no cryptographic operations.