Versioned security assessment

Report ID: SA-06DCFBF9

7/9/2026, 11:22:25 AM

ai-avatar-video security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: ai-avatar-video
Version: v2
Maintainer: 101-skills
Source: github.com/101-skills/skills/tree/main/tools/video/ai-avatar-video/
Coverage: 1 Files scanned · 268 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The real security exposure is intentional use of the belt CLI to run remote AI media jobs and install related CLI skills. Many static findings are markdown or placeholder URLs, but the skill still needs clear warnings about external processing and synthetic-media consent.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 268 Lines analyzed

17 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 21 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 33 evidence locations

Capability review items (16)

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line tells users to run npx to install an external CLI skill, which executes package manager code from the network. That is a real supply chain and command execution risk.

Medium

SKILL.md:19-28

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:55-63

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:67-76

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:80-85

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:91-104

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:108-113

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:119-124

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:128-133

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:139-152

Ruby/shell backtick execution

```bash

This bash workflow runs belt app commands and writes output files with shell redirection. It invokes an external service and creates local artifacts, so the command risk is real.

Medium

SKILL.md:158-172

Ruby/shell backtick execution

```bash

This bash workflow runs belt app commands and writes output files with shell redirection. It invokes an external service and creates local artifacts, so the command risk is real.

Medium

SKILL.md:178-194

Ruby/shell backtick execution

```bash

This bash example runs belt app commands against external AI video services. The arguments are mostly static examples, but the skill intentionally executes external commands.

Medium

SKILL.md:206-218

Ruby/shell backtick execution

```bash

This bash block uses a shell loop and interpolates a variable into a belt command. The values are hardcoded, but it still runs repeated external commands.

Medium

SKILL.md:241-259

Ruby/shell backtick execution

```bash

This block lists multiple npx skills add commands for external skill installation. Running those commands can install remote code outside this skill.

Medium

SKILL.md:259-261

Ruby/shell backtick execution

```

The span includes an inline belt app store command that queries the external CLI service. It is expected behavior, but it is still external command execution.

Low

SKILL.md:13

Hardcoded URL

![AI Avatar & Talking Head Videos](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr

This markdown image loads a remote asset from cloud.inference.sh when rendered. It is low risk, but it creates an external network request from the viewer environment.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium

SKILL.md:178-193 SKILL.md:222-227

Synthetic Presenter Misuse Risk

The skill gives workflows for UGC-style avatar videos and talking presenters. Without consent and disclosure, these outputs can support deceptive endorsements or impersonation.

The cited sections explicitly describe UGC ads, virtual presenters, and avatar generation from portraits. I found no prompt injection text or instruction to bypass consent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Medium
External CLI execution

Keep tool permissions limited to belt commands and explain that examples call remote inference.sh services. Avoid unnecessary npx install commands inside the skill body.
FIX-002
Medium
Remote media processing

Tell users that images, audio, scripts, and videos may be uploaded to external model providers. Warn users not to submit private or unlicensed media.
FIX-003
Medium
Synthetic presenter consent

Add consent and disclosure guidance for avatar videos, UGC ads, virtual influencers, and voice-driven likeness workflows.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable