📦
Audit History
ai-avatar-video - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 12, 2026, 09:45 AM | 3 confirmed | 16 | No capability change |
| v4 | Jul 12, 2026, 09:45 AM | 3 confirmed | 16 | No capability change |
| v3 | Jul 8, 2026, 02:08 PM | 2 confirmed | 15 | No capability change |
| v2 | Jul 9, 2026, 11:22 AM | 1 confirmed | 16 | No capability change |
| v1 | Jul 8, 2026, 02:08 PM | 2 confirmed | 15 | Baseline |
Audit version 5 Latest
Jul 12, 2026, 09:45 AM
Most detections are Markdown backticks, code fences, placeholder media URLs, or documentation links rather than executable backticks or suspicious destinations. Real risks remain in third-party package installation, remote media processing, shell command construction, remote image loading, and synthetic testimonial workflows without consent safeguards.
1
Files scanned
268
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Shell Injection Through Inline JSON Inputs
User-controlled scripts and media values are placed inside shell-quoted JSON. Quotes or shell substitutions can alter commands when an agent inserts input without structured serialization.
The examples directly embed text in single-quoted and double-quoted shell arguments without a JSON serializer. Generated scripts can contain quote or substitution characters.
High
Deceptive Synthetic Testimonial Risk
The skill generates testimonial-style UGC and multiple presenters without requiring likeness consent or synthetic-media disclosure. This can facilitate deceptive endorsements or impersonation.
The examples explicitly create product testimonials and several presenters, while the guidance contains no consent, disclosure, or impersonation restrictions.
Medium
External Processing of Potentially Sensitive Media
The workflows send portraits, voice scripts, audio, and videos to remote inference applications. The skill provides no consent, retention, pricing, or privacy warning.
Multiple belt app run examples submit media URLs and scripts to named remote models. No data-handling notice appears in the skill.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line explicitly directs users to execute npx against a third-party package source. This performs package resolution and installation without a pinned version.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced example instructs execution of belt login and a remote model invocation. These are intentional external commands that authenticate and submit media generation inputs.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The install link loads raw instructions from a mutable main branch on GitHub. Following mutable remote guidance creates a limited supply-chain and content-change risk.
Risk Factors
⚙️ External commands (33)
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jul 12, 2026, 09:45 AM
Most detections are Markdown backticks, code fences, placeholder media URLs, or documentation links rather than executable backticks or suspicious destinations. Real risks remain in third-party package installation, remote media processing, shell command construction, remote image loading, and synthetic testimonial workflows without consent safeguards.
1
Files scanned
268
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Shell Injection Through Inline JSON Inputs
User-controlled scripts and media values are placed inside shell-quoted JSON. Quotes or shell substitutions can alter commands when an agent inserts input without structured serialization.
The examples directly embed text in single-quoted and double-quoted shell arguments without a JSON serializer. Generated scripts can contain quote or substitution characters.
High
Deceptive Synthetic Testimonial Risk
The skill generates testimonial-style UGC and multiple presenters without requiring likeness consent or synthetic-media disclosure. This can facilitate deceptive endorsements or impersonation.
The examples explicitly create product testimonials and several presenters, while the guidance contains no consent, disclosure, or impersonation restrictions.
Medium
External Processing of Potentially Sensitive Media
The workflows send portraits, voice scripts, audio, and videos to remote inference applications. The skill provides no consent, retention, pricing, or privacy warning.
Multiple belt app run examples submit media URLs and scripts to named remote models. No data-handling notice appears in the skill.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line explicitly directs users to execute npx against a third-party package source. This performs package resolution and installation without a pinned version.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
The fenced example instructs execution of belt login and a remote model invocation. These are intentional external commands that authenticate and submit media generation inputs.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The install link loads raw instructions from a mutable main branch on GitHub. Following mutable remote guidance creates a limited supply-chain and content-change risk.
Risk Factors
⚙️ External commands (33)
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jul 8, 2026, 02:08 PM
The skill intentionally uses the belt CLI to run external avatar, TTS, transcription, and lipsync services. Most static hits are Markdown formatting or placeholder URLs, but the external command workflows, broad belt permission, and synthetic testimonial use case require user review.
1
Files scanned
268
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad External CLI Permission
The skill declares allowed-tools as Bash(belt *), which permits any belt subcommand, not only the documented avatar workflows. A future or mistaken command could access broader belt functionality than users expect.
The frontmatter directly grants wildcard belt command access. The documented commands are legitimate, but the permission is broader than the specific workflows shown.
Medium
Synthetic Testimonial And Presenter Abuse Risk
The skill includes UGC-style avatar generation and sample testimonial language. Without consent and disclosure controls, this can support deceptive synthetic endorsements or impersonation-style marketing.
The file explicitly targets UGC ads, virtual presenters, and generated testimonial-style scripts. The risk is contextual misuse rather than hidden code behavior.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to run npx to add an external belt CLI skill. This is visible supply-chain behavior, but it still installs and executes third-party tooling.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
The code block runs belt login and belt app run against pruna/p-video-avatar. This is expected functionality, but it executes an external CLI and sends media input to a service.
Medium
Ruby/shell backtick execution
```
The cited range includes the inline command belt app store --category video. It is legitimate browsing behavior, but it still invokes an external CLI.
Risk Factors
⚙️ External commands (33)
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jul 9, 2026, 11:22 AM
The real security exposure is intentional use of the belt CLI to run remote AI media jobs and install related CLI skills. Many static findings are markdown or placeholder URLs, but the skill still needs clear warnings about external processing and synthetic-media consent.
1
Files scanned
268
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Synthetic Presenter Misuse Risk
The skill gives workflows for UGC-style avatar videos and talking presenters. Without consent and disclosure, these outputs can support deceptive endorsements or impersonation.
The cited sections explicitly describe UGC ads, virtual presenters, and avatar generation from portraits. I found no prompt injection text or instruction to bypass consent.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line tells users to run npx to install an external CLI skill, which executes package manager code from the network. That is a real supply chain and command execution risk.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.
Medium
Ruby/shell backtick execution
```
The span includes an inline belt app store command that queries the external CLI service. It is expected behavior, but it is still external command execution.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jul 8, 2026, 02:08 PM
The skill intentionally uses the belt CLI to run external avatar, TTS, transcription, and lipsync services. Most static hits are Markdown formatting or placeholder URLs, but the external command workflows, broad belt permission, and synthetic testimonial use case require user review.
1
Files scanned
268
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad External CLI Permission
The skill declares allowed-tools as Bash(belt *), which permits any belt subcommand, not only the documented avatar workflows. A future or mistaken command could access broader belt functionality than users expect.
The frontmatter directly grants wildcard belt command access. The documented commands are legitimate, but the permission is broader than the specific workflows shown.
Medium
Synthetic Testimonial And Presenter Abuse Risk
The skill includes UGC-style avatar generation and sample testimonial language. Without consent and disclosure controls, this can support deceptive synthetic endorsements or impersonation-style marketing.
The file explicitly targets UGC ads, virtual presenters, and generated testimonial-style scripts. The risk is contextual misuse rather than hidden code behavior.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to run npx to add an external belt CLI skill. This is visible supply-chain behavior, but it still installs and executes third-party tooling.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
The code block runs belt login and belt app run against pruna/p-video-avatar. This is expected functionality, but it executes an external CLI and sends media input to a service.
Medium
Ruby/shell backtick execution
```
The cited range includes the inline command belt app store --category video. It is legitimate browsing behavior, but it still invokes an external CLI.
Risk Factors
⚙️ External commands (33)
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex