📦
Audit History
ai-image-generation - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 12, 2026, 09:52 AM | 3 confirmed | 2 | No capability change |
| v4 | Jul 12, 2026, 09:52 AM | 3 confirmed | 2 | No capability change |
| v3 | Jul 8, 2026, 01:58 PM | 2 confirmed | 16 | No capability change |
| v2 | Jul 9, 2026, 11:27 AM | 2 confirmed | 20 | No capability change |
| v1 | Jul 8, 2026, 01:58 PM | 2 confirmed | 16 | Baseline |
Audit version 5 Latest
Jul 12, 2026, 09:52 AM
The scanner mostly mistook Markdown formatting and model identifiers for Ruby or shell backtick execution. A remote image, mutable installation guidance, broad belt permission, and hosted processing create low-to-medium privacy and supply-chain risks. No prompt injection or malicious exfiltration intent was found.
1
Files scanned
172
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
Broad belt CLI Permission
The allowed-tools rule permits every belt subcommand, while the documented workflow needs only login, app discovery, and app execution.
The wildcard permission is explicit and broader than the commands demonstrated in the file. The impact depends on capabilities exposed by the installed belt CLI.
Medium
Unpinned Third-Party Skill Installation
The skill recommends unversioned npx installations and mutable remote instructions, so later upstream changes may alter installed behavior without review.
The commands and raw repository link contain no immutable version or commit pin. This is a clear supply-chain exposure, although no malicious upstream behavior is shown.
Medium
Prompts and Image References Sent to Hosted Models
The examples submit prompts and user-supplied image URLs to hosted model applications, which may expose sensitive creative or personal data.
The app-run examples explicitly include prompts and external image URLs as inputs. Service-side retention and access controls are not described in the skill.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The installation link targets mutable raw content on a remote repository. Following changing installation instructions creates a limited supply-chain risk.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 12, 2026, 09:52 AM
The scanner mostly mistook Markdown formatting and model identifiers for Ruby or shell backtick execution. A remote image, mutable installation guidance, broad belt permission, and hosted processing create low-to-medium privacy and supply-chain risks. No prompt injection or malicious exfiltration intent was found.
1
Files scanned
172
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
Broad belt CLI Permission
The allowed-tools rule permits every belt subcommand, while the documented workflow needs only login, app discovery, and app execution.
The wildcard permission is explicit and broader than the commands demonstrated in the file. The impact depends on capabilities exposed by the installed belt CLI.
Medium
Unpinned Third-Party Skill Installation
The skill recommends unversioned npx installations and mutable remote instructions, so later upstream changes may alter installed behavior without review.
The commands and raw repository link contain no immutable version or commit pin. This is a clear supply-chain exposure, although no malicious upstream behavior is shown.
Medium
Prompts and Image References Sent to Hosted Models
The examples submit prompts and user-supplied image URLs to hosted model applications, which may expose sensitive creative or personal data.
The app-run examples explicitly include prompts and external image URLs as inputs. Service-side retention and access controls are not described in the skill.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The installation link targets mutable raw content on a remote repository. Following changing installation instructions creates a limited supply-chain risk.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 8, 2026, 01:58 PM
The skill is documentation-only, but it authorizes and instructs use of the external belt CLI. Most static backtick findings are Markdown formatting or model IDs, while command examples and install commands are real external command guidance. No prompt injection text was found, but prompts and image inputs may be sent to third-party services.
1
Files scanned
172
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad belt CLI Execution Permission
The skill grants Bash access for any belt subcommand. A compromised or changed instruction could use belt beyond the documented image workflows.
The allowed-tools front matter explicitly permits Bash(belt *). The risk is contextual because belt behavior depends on the installed CLI and account permissions.
Medium
External Image Service Data Transfer
The documented workflows send prompts and image URLs to inference.sh hosted apps. Sensitive prompts, private image URLs, or client assets may leave the user environment.
The examples directly invoke hosted model apps and include prompt text or image URL fields. This confirms external processing, though it appears to be the intended feature rather than malicious behavior.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This is an explicit npx install command from a community skill. Following it can install another skill through an external package workflow, so it has supply-chain risk even though it is documentation.
Medium
SKILL.md:19-24SKILL.md:50-52SKILL.md:58-63SKILL.md:67-72SKILL.md:76-80SKILL.md:84-86SKILL.md:90-94SKILL.md:98-103SKILL.md:107-111SKILL.md:115-119SKILL.md:123-125SKILL.md:129-134SKILL.md:138-162
Ruby/shell backtick execution · 13 occurrences
```bash
This code block instructs users to run belt login and belt app run against a hosted image service. The command is intentional, but it executes an external CLI and sends prompt data outside the workspace.
Medium
Ruby/shell backtick execution
```
This range includes a documented belt app store command for browsing remote apps. It is a lower-confidence command risk because the static location starts on a closing fence, but the referenced command still uses the external CLI.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 9, 2026, 11:27 AM
Most Ruby backtick findings are Markdown false positives, but several examples intentionally run the belt CLI and npx installers. The skill has real external command and network exposure because prompts, image URLs, and install commands can leave the reviewed package.
1
Files scanned
172
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad Belt CLI Permission
The skill allows Bash(belt *), which permits any belt subcommand instead of only the image-generation commands shown in examples. This broad permission can affect account state or call remote services beyond the narrow workflow.
The allowed-tools front matter directly grants Bash access to every belt subcommand. The rest of the skill relies on belt for login, model discovery, and app execution.
Medium
External Prompt and Image Data Disclosure
The documented workflows send prompts and image URLs to inference.sh apps and model providers, but the skill does not include a privacy warning. Users may submit sensitive images or unreleased visual concepts without clear notice.
The cited examples include prompts and image_url or images fields for remote app runs. The file does not show a disclosure about third-party processing or sensitive data handling.
Capability review items (20)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The skill tells users to run npx skills add belt-sh/cli, which can install community package code outside the reviewed skill. This is a real supply-chain command risk, although it is not Ruby backtick execution.
Medium
SKILL.md:19-24SKILL.md:50-52SKILL.md:58-63SKILL.md:67-72SKILL.md:76-80SKILL.md:84-86SKILL.md:90-94SKILL.md:98-103SKILL.md:107-111SKILL.md:115-119SKILL.md:123-125SKILL.md:129-134SKILL.md:138-162
Ruby/shell backtick execution · 13 occurrences
```bash
The quick start runs belt login and belt app run commands through an external CLI. These commands can authenticate an account and send prompt data to outside services.
Low
Hardcoded URL
Generate images with 50+ AI models via [inference.sh](https://inference.sh) CLI.
The hardcoded inference.sh URL identifies the external service the skill depends on. Using the skill can route prompts or images to that service, so the dependency is real.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The install instructions link points to raw GitHub content outside the reviewed package. Remote install guidance can change after review and influence setup commands.
Low
Hardcoded URL
"images": ["https://your-image.jpg"]
The URL is a placeholder, but it appears inside examples that send image URLs to external belt apps. This documents a real data-sharing path when users provide images.
Low
Hardcoded URL
belt app run falai/topaz-image-upscaler --input '{"image_url": "https://..."}'
The URL is a placeholder, but it appears inside examples that send image URLs to external belt apps. This documents a real data-sharing path when users provide images.
Low
Hardcoded URL
"images": ["https://img1.jpg", "https://img2.jpg"],
The URL is a placeholder, but it appears inside examples that send image URLs to external belt apps. This documents a real data-sharing path when users provide images.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 8, 2026, 01:58 PM
The skill is documentation-only, but it authorizes and instructs use of the external belt CLI. Most static backtick findings are Markdown formatting or model IDs, while command examples and install commands are real external command guidance. No prompt injection text was found, but prompts and image inputs may be sent to third-party services.
1
Files scanned
172
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Broad belt CLI Execution Permission
The skill grants Bash access for any belt subcommand. A compromised or changed instruction could use belt beyond the documented image workflows.
The allowed-tools front matter explicitly permits Bash(belt *). The risk is contextual because belt behavior depends on the installed CLI and account permissions.
Medium
External Image Service Data Transfer
The documented workflows send prompts and image URLs to inference.sh hosted apps. Sensitive prompts, private image URLs, or client assets may leave the user environment.
The examples directly invoke hosted model apps and include prompt text or image URL fields. This confirms external processing, though it appears to be the intended feature rather than malicious behavior.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This is an explicit npx install command from a community skill. Following it can install another skill through an external package workflow, so it has supply-chain risk even though it is documentation.
Medium
SKILL.md:19-24SKILL.md:50-52SKILL.md:58-63SKILL.md:67-72SKILL.md:76-80SKILL.md:84-86SKILL.md:90-94SKILL.md:98-103SKILL.md:107-111SKILL.md:115-119SKILL.md:123-125SKILL.md:129-134SKILL.md:138-162
Ruby/shell backtick execution · 13 occurrences
```bash
This code block instructs users to run belt login and belt app run against a hosted image service. The command is intentional, but it executes an external CLI and sends prompt data outside the workspace.
Medium
Ruby/shell backtick execution
```
This range includes a documented belt app store command for browsing remote apps. It is a lower-confidence command risk because the static location starts on a closing fence, but the referenced command still uses the external CLI.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex