Five findings are confirmed because the skill directs users or agents to run external CLI commands, invoke remote applications, or install unpinned skills. The remaining findings are Markdown syntax, ordinary links, marketing text, or event-planning guidance with no shell execution or reconnaissance behavior.
1
Files scanned
263
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 explicitly instructs users to run npx to install an external skill from an unpinned source. This creates a real command-execution and supply-chain surface.
The Bash block runs belt login and two belt app commands against external services. These are intentional external commands, although the backticks themselves are Markdown fences.
Five findings are confirmed because the skill directs users or agents to run external CLI commands, invoke remote applications, or install unpinned skills. The remaining findings are Markdown syntax, ordinary links, marketing text, or event-planning guidance with no shell execution or reconnaissance behavior.
1
Files scanned
263
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 explicitly instructs users to run npx to install an external skill from an unpinned source. This creates a real command-execution and supply-chain surface.
The Bash block runs belt login and two belt app commands against external services. These are intentional external commands, although the backticks themselves are Markdown fences.
Most alerts are Markdown backticks or code fences, not Ruby or shell backtick execution. The skill does contain intentional installation and belt commands, and hosted app calls may send launch materials to third-party services.
Hosted belt app commands send prompts, search queries, and potentially image inputs to external providers without a privacy warning.
The documented belt app run commands target hosted image and search services with explicit user-supplied inputs. The file provides no data-handling caution.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.