Audit History

SKILL.md:19-26 SKILL.md:82-86 SKILL.md:90-94 SKILL.md:98-102 SKILL.md:106-111 SKILL.md:115-119 SKILL.md:123-127 SKILL.md:143-149 SKILL.md:171-180

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Line 7 instructs users to execute an npx package installer, which runs third-party code and creates a supply-chain risk.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The fenced shell example runs belt login and belt app run, so external command execution is an intended capability.

Low

Python HTTP libraries

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The Python sample imports requests and performs an outbound GET request to example.com.

Low

Python HTTP libraries

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The Python sample uses requests to call the public GitHub API.

Low

SKILL.md:13

Hardcoded URL

![Python Code Executor](https://cloud.inference.sh/u/33sqbmzt3mrg2xxphnhw5g5ear/01k8d8b4mckh6z89dhtx

The remote image URL may be fetched when the skill documentation is rendered, creating an external request and tracking surface.

Low

Hardcoded URL

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The URL is passed directly to requests.get in executable example code, producing an outbound network request.

Low

SKILL.md:3 SKILL.md:22-25

Hardcoded URL

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The hardcoded GitHub API URL is passed to requests.get and is actively contacted by the example.

Risk Factors

Audited by: codex

Audit version 4

Jul 12, 2026, 10:13 AM

The skill intentionally invokes the belt CLI, submits arbitrary Python to a third-party execution service, and demonstrates outbound HTTP requests. Most backtick detections are Markdown formatting, and the reconnaissance alert is unsupported, but remote execution, network access, and unpinned npx installation remain real risks.

1

Files scanned

188

Lines analyzed

18

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

Third-Party Code Submission Boundary

The skill sends Python source through the inference.sh belt application. Submitted source may contain user data or secrets that cross a third-party service boundary.

The description names inference.sh, and the quick start submits Python source with belt app run. The document does not state a local-only execution path.

Capability review items (15)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-26 SKILL.md:82-86 SKILL.md:90-94 SKILL.md:98-102 SKILL.md:106-111 SKILL.md:115-119 SKILL.md:123-127 SKILL.md:143-149 SKILL.md:171-180

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Line 7 instructs users to execute an npx package installer, which runs third-party code and creates a supply-chain risk.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The fenced shell example runs belt login and belt app run, so external command execution is an intended capability.

Low

Python HTTP libraries

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The Python sample imports requests and performs an outbound GET request to example.com.

Low

Python HTTP libraries

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The Python sample uses requests to call the public GitHub API.

Low

SKILL.md:13

Hardcoded URL

![Python Code Executor](https://cloud.inference.sh/u/33sqbmzt3mrg2xxphnhw5g5ear/01k8d8b4mckh6z89dhtx

The remote image URL may be fetched when the skill documentation is rendered, creating an external request and tracking surface.

Low

Hardcoded URL

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The URL is passed directly to requests.get in executable example code, producing an outbound network request.

Low

SKILL.md:3-4 SKILL.md:23-25 SKILL.md:160-165

Hardcoded URL

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The hardcoded GitHub API URL is passed to requests.get and is actively contacted by the example.

Risk Factors

Audited by: codex

Audit version 3

Jul 8, 2026, 02:27 PM

Most static backtick findings are Markdown formatting or package names, not Ruby shell execution. Real risk remains because the skill uses the external belt CLI to run arbitrary Python and includes network-capable examples. No prompt injection attempt was found in the reviewed SKILL.md file.

1

Files scanned

188

Lines analyzed

21

Review items

0

False positives ignored

Confirmed security concerns (1)

High

Arbitrary Python Execution Through External Service

The skill grants Bash(belt *) and instructs the agent to send Python code to infsh/python-executor. This creates remote code execution and data exposure risk if prompts include secrets.

The frontmatter permits Bash(belt *) and the quick start sends Python code through belt. The use cases also state that the skill can run any Python script.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line tells users to run npx to install an external skill, which can execute third-party package code. It is documented behavior, but it is a real supply-chain risk.

Medium

SKILL.md:19-26 SKILL.md:82-86 SKILL.md:90-94 SKILL.md:98-102 SKILL.md:106-111 SKILL.md:115-119 SKILL.md:123-127 SKILL.md:143-149 SKILL.md:171-180

Ruby/shell backtick execution

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The line declares dependence on the external belt CLI and links to remote install instructions. This is legitimate dependency documentation, but it expands trust beyond the local skill.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The quick-start block runs belt login and belt app run with a Python payload. That intentionally invokes an external CLI to execute code through a hosted service.

Medium

SKILL.md:149-166

Ruby/shell backtick execution

```

This range includes use-case text saying the skill can run any Python script. That broad execution intent is a real code-execution risk even though the static trigger is noisy.

Low

Python HTTP libraries

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The example imports requests and performs an HTTP GET from sandboxed Python. This confirms network egress capability, although the target is a benign sample domain.

Low

Python HTTP libraries

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The example imports requests and calls the GitHub API from sandboxed Python. This confirms outbound network capability in normal skill use.

Low

SKILL.md:3

Hardcoded URL

description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen

The description states execution is via inference.sh, so the skill depends on a remote service. This is a network dependency, not evidence of malicious exfiltration.

Low

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The line links to remote install instructions for the required CLI. This is not malicious by itself, but it creates an external dependency users must trust.

Low

Hardcoded URL

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The web scraping example contains a hardcoded public URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior.

Low

SKILL.md:4 SKILL.md:23-25 SKILL.md:160

Hardcoded URL

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The API example contains a hardcoded GitHub API URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior.

Risk Factors

Audited by: codex

Audit version 2

Jul 9, 2026, 11:42 AM

The Markdown backtick findings are mostly documentation false positives, but the real belt examples execute user-supplied Python through an external service. Network access is an intended feature through HTTP examples and external service links. No prompt injection text was found, but the skill remains high risk because it enables broad remote code execution.

1

Files scanned

188

Lines analyzed

20

Review items

0

False positives ignored

Confirmed security concerns (1)

High

Broad Remote Python Execution Capability

The skill grants Bash access to belt commands and documents running arbitrary Python through infsh/python-executor. This is an intentional capability, but it can execute code, perform network requests, and return files through an external service.

The allowed-tools declaration limits Bash to belt, and multiple examples use belt app run with user-supplied Python. The use case list explicitly says it can run any Python script.

Capability review items (17)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-26 SKILL.md:82-86 SKILL.md:90-94 SKILL.md:98-102 SKILL.md:106-111 SKILL.md:115-119 SKILL.md:123-127 SKILL.md:143-149 SKILL.md:171-180

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line instructs users to run npx to install another skill, which is real external command execution. The command may install third-party marketplace content, so it should require user consent.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

This bash example runs belt app run to execute supplied Python through an external service. The command is intentional, but it can execute arbitrary user-provided code and needs consent controls.

Low

Python HTTP libraries

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The example imports requests and performs an HTTP GET from Python, so network egress is an intended capability. It is documented behavior, but it can contact external sites.

Low

Python HTTP libraries

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The example imports requests and performs an HTTP GET from Python, so network egress is an intended capability. It is documented behavior, but it can contact external sites.

Low

SKILL.md:3

Hardcoded URL

description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen

The description identifies inference.sh as the external execution service. This is a real network dependency for the skill, even though it is disclosed.

Low

SKILL.md:13

Hardcoded URL

![Python Code Executor](https://cloud.inference.sh/u/33sqbmzt3mrg2xxphnhw5g5ear/01k8d8b4mckh6z89dhtx

The README embeds a remote image URL, which can trigger an outbound request when rendered. The risk is low because it is a static asset reference.

Low

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The skill links to external install instructions for the required CLI. This is a disclosed network dependency, but it relies on external content.

Low

Hardcoded URL

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The sample Python code contains a hardcoded external URL and performs network access. The URL is part of documented examples, but network egress is real.

Low

SKILL.md:3-4 SKILL.md:23-25 SKILL.md:160-165

Hardcoded URL

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The sample Python code contains a hardcoded external URL and performs network access. The URL is part of documented examples, but network egress is real.

Risk Factors

Audited by: codex

Audit version 1

Jul 8, 2026, 02:27 PM

Most static backtick findings are Markdown formatting or package names, not Ruby shell execution. Real risk remains because the skill uses the external belt CLI to run arbitrary Python and includes network-capable examples. No prompt injection attempt was found in the reviewed SKILL.md file.

1

Files scanned

188

Lines analyzed

21

Review items

0

False positives ignored

Confirmed security concerns (1)

High

Arbitrary Python Execution Through External Service

The skill grants Bash(belt *) and instructs the agent to send Python code to infsh/python-executor. This creates remote code execution and data exposure risk if prompts include secrets.

The frontmatter permits Bash(belt *) and the quick start sends Python code through belt. The use cases also state that the skill can run any Python script.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line tells users to run npx to install an external skill, which can execute third-party package code. It is documented behavior, but it is a real supply-chain risk.

Medium

SKILL.md:19-26 SKILL.md:82-86 SKILL.md:90-94 SKILL.md:98-102 SKILL.md:106-111 SKILL.md:115-119 SKILL.md:123-127 SKILL.md:143-149 SKILL.md:171-180

Ruby/shell backtick execution

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The line declares dependence on the external belt CLI and links to remote install instructions. This is legitimate dependency documentation, but it expands trust beyond the local skill.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The quick-start block runs belt login and belt app run with a Python payload. That intentionally invokes an external CLI to execute code through a hosted service.

Medium

SKILL.md:149-166

Ruby/shell backtick execution

```

This range includes use-case text saying the skill can run any Python script. That broad execution intent is a real code-execution risk even though the static trigger is noisy.

Low

Python HTTP libraries

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The example imports requests and performs an HTTP GET from sandboxed Python. This confirms network egress capability, although the target is a benign sample domain.

Low

Python HTTP libraries

"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo

The example imports requests and calls the GitHub API from sandboxed Python. This confirms outbound network capability in normal skill use.

Low

SKILL.md:3

Hardcoded URL

description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen

The description states execution is via inference.sh, so the skill depends on a remote service. This is a network dependency, not evidence of malicious exfiltration.

Low

Hardcoded URL

> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer

The line links to remote install instructions for the required CLI. This is not malicious by itself, but it creates an external dependency users must trust.

Low

Hardcoded URL

"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example

The web scraping example contains a hardcoded public URL used by requests.get. This is benign sample code, but it confirms outbound HTTP behavior.

Low