Versioned security assessment

Report ID: SA-B959EBFD

7/8/2026, 1:58:41 PM

ai-image-generation security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ai-image-generation
Version
v3
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/tools/image/ai-image-generation/
Coverage
1 Files scanned · 172 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is documentation-only, but it authorizes and instructs use of the external belt CLI. Most static backtick findings are Markdown formatting or model IDs, while command examples and install commands are real external command guidance. No prompt injection text was found, but prompts and image inputs may be sent to third-party services.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 172 Lines analyzed

18 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 44 evidence locations

Capability review items (16)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This is an explicit npx install command from a community skill. Following it can install another skill through an external package workflow, so it has supply-chain risk even though it is documentation.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
This code block instructs users to run belt login and belt app run against a hosted image service. The command is intentional, but it executes an external CLI and sends prompt data outside the workspace.
Medium
SKILL.md:50-52
Ruby/shell backtick execution
```bash
This code block instructs users to run belt app store against the hosted app catalog. The command is intentional, but it relies on an external CLI and remote service.
Medium
SKILL.md:58-63
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted GPT-Image-2 workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:67-72
Ruby/shell backtick execution
```bash
This code block runs belt app run for image editing and includes a source image URL. The workflow can disclose user-provided image locations to an external service.
Medium
SKILL.md:76-80
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted FLUX workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:84-86
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted FLUX Klein workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:90-94
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted Gemini image workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:98-103
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted Grok image workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:107-111
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted Reve workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:115-119
Ruby/shell backtick execution
```bash
This code block runs belt app run for a hosted Seedream workflow. The command sends prompt data to an external model service.
Medium
SKILL.md:123-125
Ruby/shell backtick execution
```bash
This code block runs belt app run for upscaling and accepts an image URL. The workflow can disclose user-provided image locations to an external service.
Medium
SKILL.md:129-134
Ruby/shell backtick execution
```bash
This code block runs belt app run for image stitching and includes image URLs. The workflow can disclose user-provided image locations to an external service.
Medium
SKILL.md:138-162
Ruby/shell backtick execution
```bash
This code block lists multiple npx skills add commands for related skills. They are optional documentation, but following them can install external community skills.
Medium
SKILL.md:162-164
Ruby/shell backtick execution
```
This range includes a documented belt app store command for browsing remote apps. It is a lower-confidence command risk because the static location starts on a closing fence, but the referenced command still uses the external CLI.
Low
SKILL.md:13
Hardcoded URL
![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w
This line embeds a remote image from cloud.inference.sh. Rendering the documentation may fetch third-party content and expose viewer metadata to that host.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:4
Broad belt CLI Execution Permission
The skill grants Bash access for any belt subcommand. A compromised or changed instruction could use belt beyond the documented image workflows.
The allowed-tools front matter explicitly permits Bash(belt *). The risk is contextual because belt behavior depends on the installed CLI and account permissions.
RISK-002 Medium
SKILL.md:11SKILL.md:58-71SKILL.md:121-133
External Image Service Data Transfer
The documented workflows send prompts and image URLs to inference.sh hosted apps. Sensitive prompts, private image URLs, or client assets may leave the user environment.
The examples directly invoke hosted model apps and include prompt text or image URL fields. This confirms external processing, though it appears to be the intended feature rather than malicious behavior.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Broad belt CLI permission
    Restrict allowed tools to documented belt commands, or require confirmation before login, install, or account-changing operations.
  2. FIX-002
    Medium
    External model processing
    Add a clear privacy notice that prompts, uploaded images, and image URLs are sent to inference.sh and model providers.
  3. FIX-003
    Medium
    Optional external skill installation commands
    Separate related-skill installs from the main workflow and tell users to review packages before running npx skills add.
  4. FIX-004
    Low
    Remote documentation image
    Replace the remote Markdown image with a local asset or remove it to avoid automatic third-party fetches.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable