Nine findings are confirmed: unpinned npx installation commands and belt workflows that invoke external search, browser, code-execution, and image-processing services. The other 30 findings are Markdown syntax, documentation links, placeholder URLs, or comparison text. External processing can disclose research inputs, but no malicious intent, credential theft, destructive command, or prompt injection was found.
The belt workflows submit research queries, target URLs, screenshots, and plotting code to external inference.sh apps. Confidential inputs could leave the local environment.
The commands explicitly pass queries, URLs, code, and image paths to named belt applications. The external processing is clear, although disclosure impact depends on user input.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Nine findings are confirmed: unpinned npx installation commands and belt workflows that invoke external search, browser, code-execution, and image-processing services. The other 30 findings are Markdown syntax, documentation links, placeholder URLs, or comparison text. External processing can disclose research inputs, but no malicious intent, credential theft, destructive command, or prompt injection was found.
The belt workflows submit research queries, target URLs, screenshots, and plotting code to external inference.sh apps. Confidential inputs could leave the local environment.
The commands explicitly pass queries, URLs, code, and image paths to named belt applications. The external processing is clear, although disclosure impact depends on user input.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Two unpinned npx package installation commands are confirmed supply-chain risks. The other 37 findings are false positives from Markdown formatting, fixed-argument examples, placeholder URLs, and ordinary comparison text.
1
Files scanned
316
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run an unpinned npx package installation. Installing and executing a mutable third-party package creates a supply-chain risk.
The code block instructs users to install two unpinned packages through npx. Mutable third-party packages can execute installation code and create supply-chain exposure.