Versioned security assessment

Report ID: SA-C47A0D68

7/12/2026, 9:47:48 AM

product-hunt-launch security assessment v1

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
product-hunt-launch
Version
v1
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/guides/product/product-hunt-launch/
Coverage
1 Files scanned · 263 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most alerts are Markdown backticks or code fences, not Ruby or shell backtick execution. The skill does contain intentional installation and belt commands, and hosted app calls may send launch materials to third-party services.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 263 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 16 evidence locations

Capability review items (5)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line contains an npx command that installs an external skill. It is intentional package execution, although it is not Ruby backtick syntax.
Medium
SKILL.md:17-31
Ruby/shell backtick execution
```bash
This fenced block contains belt login and hosted app commands. They intentionally invoke an external CLI and can make network requests.
Medium
SKILL.md:68-95
Ruby/shell backtick execution
```bash
The fenced block includes belt commands for hosted image generation and image stitching. These are deliberate external CLI operations.
Medium
SKILL.md:214-229
Ruby/shell backtick execution
```bash
The fenced block invokes belt search apps against hosted services. These commands intentionally execute an external CLI and send search queries.
Medium
SKILL.md:255-259
Ruby/shell backtick execution
```bash
The block contains three npx commands that install external skills. Running them can download and execute package tooling.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:20-30SKILL.md:68-94SKILL.md:214-228
Third-Party Processing of Launch Materials
Hosted belt app commands send prompts, search queries, and potentially image inputs to external providers without a privacy warning.
The documented belt app run commands target hosted image and search services with explicit user-supplied inputs. The file provides no data-handling caution.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The skill recommends installing external skills and a CLI without a pinned version or integrity check.
    Pin trusted versions where supported, identify the package source, and tell users to review installation instructions before execution.
  2. FIX-002
    Medium
    Hosted image and search commands may transmit product details or local assets to third-party services.
    Add a privacy warning and advise users to remove secrets, customer data, and confidential launch details before running hosted apps.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
c47a0d6818048b11e035c26cf0a679adb938020c
Content hash
df2ba091451e67a7d657681d7bbdb1288b2329a6a32617c383b6bf4fe06b8ed8
Tree hash
d309c14153206a2c5c9e48ccf532e60352af0d24968ea2d1463b30c041e05956
Skill path
skills/101-skills/product-hunt-launch
Audit payload hash
3590b328735448e18e1931753e092e6c

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable