Versioned security assessment

Report ID: SA-635F69FB

7/13/2026, 11:01:18 AM

product-hunt-launch security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
product-hunt-launch
Version
v3
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/guides/product/product-hunt-launch/
Coverage
1 Files scanned · 263 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Five findings are confirmed because the skill directs users or agents to run external CLI commands, invoke remote applications, or install unpinned skills. The remaining findings are Markdown syntax, ordinary links, marketing text, or event-planning guidance with no shell execution or reconnaissance behavior.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 263 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 16 evidence locations

Capability review items (5)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 explicitly instructs users to run npx to install an external skill from an unpinned source. This creates a real command-execution and supply-chain surface.
Medium
SKILL.md:17-31
Ruby/shell backtick execution
```bash
The Bash block runs belt login and two belt app commands against external services. These are intentional external commands, although the backticks themselves are Markdown fences.
Medium
SKILL.md:68-95
Ruby/shell backtick execution
```bash
The Bash block invokes several belt applications for image generation and composition. These commands can send prompts and selected image files to external services.
Medium
SKILL.md:214-229
Ruby/shell backtick execution
```bash
The Bash block runs three belt applications that send research queries to external search services. This is intentional command execution and network use.
Medium
SKILL.md:255-259
Ruby/shell backtick execution
```bash
The Bash block provides three npx commands that install external skills without pinned revisions. Running them introduces command-execution and dependency supply-chain risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The installation commands reference mutable, unpinned skill sources.
    Pin each dependency to a reviewed commit or release, publish integrity information, and require confirmation before installation.
  2. FIX-002
    Medium
    The belt examples invoke remote applications and may transmit prompts or selected files to third-party services.
    Disclose the destination services, require confirmation before each call, and warn users not to submit confidential content.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
Content hash
030fdb35cfa915180ba550eea73c28cc607f75d57d83e65cbeaf0e486ab9211a
Tree hash
78825be7e9cf5a2d502e020210d67db454cf725cab150eeed9d4205c7776f795
Skill path
skills/101-skills/product-hunt-launch
Audit payload hash
947a3551d5425b970030617ec8d9e4c1

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable