Audit History

SKILL.md:19-24 SKILL.md:48-52 SKILL.md:58-62 SKILL.md:68-72 SKILL.md:78-82 SKILL.md:88-92 SKILL.md:98-108 SKILL.md:112-122 SKILL.md:134-143

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Line 7 instructs users to execute npx and install a third-party skill, creating package and supply-chain exposure.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

Lines 19 through 24 run belt login and a remote Tavily app, which are intentional external command executions.

Medium

Ruby/shell backtick execution

```

The finding range includes the instruction to run belt app store, which invokes an external CLI.

Low

Hardcoded URL

![Web Search & Extraction](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgndq

Line 13 embeds a remotely hosted image, allowing the host to observe requests from documentation viewers.

Audited by: codex

Audit version 4

Jul 12, 2026, 10:27 AM

The skill intentionally runs belt and npx commands, including third-party installation and remote search requests. Most static alerts are Markdown formatting, while several command blocks and one remote image are genuine security surfaces. The workflows also disclose inputs externally and may pass untrusted web content into language models.

1

Files scanned

153

Lines analyzed

16

Review items

0

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:48-91

User Data Sent to External Search Providers

The examples send user queries, questions, and target URLs through belt to Tavily, Exa, and inference.sh services.

The documented commands explicitly place queries, questions, and URLs in inputs for remote provider applications.

Medium

SKILL.md:96-121

Untrusted Web Content Used in LLM Workflows

The workflows recommend summarizing retrieved web material without guidance for resisting instructions embedded in that material.

The examples combine search or extraction with LLM prompts, although placeholders prevent fully automatic data flow.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-24 SKILL.md:48-52 SKILL.md:58-62 SKILL.md:68-72 SKILL.md:78-82 SKILL.md:88-92 SKILL.md:98-108 SKILL.md:112-122 SKILL.md:134-143

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

Line 7 instructs users to execute npx and install a third-party skill, creating package and supply-chain exposure.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

Lines 19 through 24 run belt login and a remote Tavily app, which are intentional external command executions.

Medium

Ruby/shell backtick execution

```

The finding range includes the instruction to run belt app store, which invokes an external CLI.

Low

SKILL.md:23 SKILL.md:49-60 SKILL.md:100-120

Hardcoded URL

![Web Search & Extraction](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgndq

Line 13 embeds a remotely hosted image, allowing the host to observe requests from documentation viewers.

Audited by: codex

Audit version 3

Jul 8, 2026, 02:30 PM

Most static findings are Markdown backticks, code fences, app identifiers, or documentation links. Real residual risk comes from visible external belt commands, the broad Bash(belt *) permission, and third-party handling of queries or extracted content. No prompt injection language or covert credential access was found.

1

Files scanned

153

Lines analyzed

16

Review items

0

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:4

Broad Belt CLI Permission

The frontmatter grants Bash(belt *), which allows any belt subcommand. This is broader than the documented Tavily and Exa workflows.

The wildcard permission is explicit in the skill frontmatter. The risk is permission breadth rather than hidden malicious intent.

Low

Third-Party Research Data Disclosure

The examples submit queries, URLs, search results, and page content to Tavily, Exa, and OpenRouter Claude apps. Users could send confidential material by mistake.

The command examples clearly pass user queries, URLs, and prompts to hosted belt apps. The behavior is documented and aligned with the skill purpose.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-24 SKILL.md:48-52 SKILL.md:58-62 SKILL.md:68-72 SKILL.md:78-82 SKILL.md:88-92 SKILL.md:98-108 SKILL.md:112-122 SKILL.md:134-143

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line instructs users to run npx skills add for another CLI skill, which can install external marketplace code. It is visible documentation, so confidence is moderate.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The quick start block includes belt login and belt app run commands. These are intentional commands, but they execute an external CLI against hosted services.

Medium

Ruby/shell backtick execution

```

The range includes an inline belt app store command. It is low impact and visible, but it still encourages use of the external CLI command surface.

Low

Hardcoded URL

![Web Search & Extraction](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgndq

The Markdown image points to a remote cloud.inference.sh asset that may be fetched when rendered. This is visible and low severity, but it is a real external request.

Audited by: codex

Audit version 2

Jul 9, 2026, 11:58 AM

The skill has legitimate web search and extraction behavior, but several examples execute the external belt CLI and send queries or URLs to providers. Most markdown backtick and hardcoded URL findings are documentation noise, while the broad Bash(belt *) allowlist is a real scope concern.

1

Files scanned

153

Lines analyzed

13

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:4

Overbroad Belt Command Allowlist

The skill allows Bash(belt *) instead of limiting commands to the documented search and extraction apps. A model could invoke unrelated belt subcommands or apps within that wildcard scope.

The front matter explicitly grants Bash access for any belt command. The documented use case needs only a narrower set of belt app run commands.

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-24 SKILL.md:48-52 SKILL.md:58-62 SKILL.md:68-72 SKILL.md:78-82 SKILL.md:88-92 SKILL.md:98-108 SKILL.md:112-122 SKILL.md:134-143

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

This line asks users to run an npx installation command for another skill. It is an external package execution path and should be treated as a supply-chain risk.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The cited quick start block includes belt login and a belt app run command. These commands execute an external CLI and make networked service calls.

Audited by: codex

Audit version 1

Jul 8, 2026, 02:30 PM

Most static findings are Markdown backticks, code fences, app identifiers, or documentation links. Real residual risk comes from visible external belt commands, the broad Bash(belt *) permission, and third-party handling of queries or extracted content. No prompt injection language or covert credential access was found.

1

Files scanned

153

Lines analyzed

16

Review items

0

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:4

Broad Belt CLI Permission

The frontmatter grants Bash(belt *), which allows any belt subcommand. This is broader than the documented Tavily and Exa workflows.

The wildcard permission is explicit in the skill frontmatter. The risk is permission breadth rather than hidden malicious intent.

Low

SKILL.md:23 SKILL.md:49-60 SKILL.md:100-120

Third-Party Research Data Disclosure

The examples submit queries, URLs, search results, and page content to Tavily, Exa, and OpenRouter Claude apps. Users could send confidential material by mistake.

The command examples clearly pass user queries, URLs, and prompts to hosted belt apps. The behavior is documented and aligned with the skill purpose.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:19-24 SKILL.md:48-52 SKILL.md:58-62 SKILL.md:68-72 SKILL.md:78-82 SKILL.md:88-92 SKILL.md:98-108 SKILL.md:112-122 SKILL.md:134-143

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line instructs users to run npx skills add for another CLI skill, which can install external marketplace code. It is visible documentation, so confidence is moderate.

Medium

Ruby/shell backtick execution · 9 occurrences

```bash

The quick start block includes belt login and belt app run commands. These are intentional commands, but they execute an external CLI against hosted services.

Medium

Ruby/shell backtick execution

```

The range includes an inline belt app store command. It is low impact and visible, but it still encourages use of the external CLI command surface.

Low