Versioned security assessment

Report ID: SA-635F69FB

7/13/2026, 11:04:05 AM

product-photography security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
product-photography
Version
v3
Maintainer
101-skills
Source
github.com/101-skills/skills/tree/main/guides/photo/product-photography/
Coverage
1 Files scanned · 294 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Review confirmed two medium supply-chain risks from unpinned npx skill installations. The remaining 32 static findings are Markdown fences, literal belt examples, inline command names, or documentation URLs without shell interpolation. Separate semantic review found external image transmission and broad belt wildcard permission; no prompt injection or malicious intent was found.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 294 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 32 evidence locations

Capability review items (2)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The instruction runs npx to install a third-party skill without a version or commit pin. Mutable dependency resolution creates a supply-chain execution risk.
Medium
SKILL.md:286-290
Ruby/shell backtick execution
```bash
The documented commands install third-party skills through npx without immutable version or commit pins. A compromised or replaced upstream source could execute during installation.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:17-24SKILL.md:252-268
External Product Data Transmission
The workflow submits prompts to remote inference applications and can upload local product images during editing or upscaling. This may expose unreleased products or image metadata to an external service.
The documented belt commands invoke named remote applications, and the editing examples pass local image filenames. The guide identifies inference.sh as the underlying service.
RISK-002 Medium
SKILL.md:4
Broad Belt CLI Permission
The allowed-tools declaration permits any belt subcommand, although the guide requires only a limited set of generation actions. A manipulated request could invoke other belt capabilities without a narrower permission boundary.
The wildcard permission is explicit, but the available belt subcommand surface is not documented in this skill. The breadth of access creates a credible least-privilege concern.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The skill recommends installing third-party skills without version or commit pins.
    Pin every npx skill source to a reviewed immutable version or commit, and document a verification process before installation.
  2. FIX-002
    Medium
    Remote inference workflows can transmit product prompts and local product images.
    Disclose the receiving service, data retention terms, and image-upload behavior before users run generation, editing, or upscaling commands.
  3. FIX-003
    Medium
    The Bash permission permits every belt subcommand.
    Restrict allowed tools to required belt subcommands where supported, or require user confirmation before commands that upload data.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
Content hash
e74ae1665bdfd24a58450c995f2e07fa3e967b48c26831611350b118fe31e6fc
Tree hash
a4bca2d18aea2aae3ad42711bf4c55b101f35c9f7f41e78dd59769d68dd273fa
Skill path
skills/101-skills/product-photography
Audit payload hash
0992a1971fb7db7221e89b4e57b92d8d

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable