The skill is not malicious, but it depends on broad belt CLI access and third-party inference services. Real command and network findings were confirmed, while markdown diagrams, templates, and the line 207 reconnaissance hit were dismissed as false positives. Publication should require clear user confirmation for login, installs, remote app runs, and possible service costs.
The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.
The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source.
The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service.
The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use.
Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc
Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing.
Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency.
The skill is not malicious, but it depends on broad belt CLI access and third-party inference services. Real command and network findings were confirmed, while markdown diagrams, templates, and the line 207 reconnaissance hit were dismissed as false positives. Publication should require clear user confirmation for login, installs, remote app runs, and possible service costs.
The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.
The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source.
The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service.
The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use.
Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc
Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing.
Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency.
The static findings are false positives caused by Markdown code fences, fixed CLI examples, and disclosed documentation links. I found no prompt-injection text, hidden exfiltration intent, dynamic command construction, or system reconnaissance in SKILL.md.
The confirmed risks are limited to documented external CLI usage through npx and belt commands. Most static detections are Markdown code fences, diagrams, or prose, and no prompt injection, data exfiltration intent, or system reconnaissance was found.
1
Files scanned
282
Lines analyzed
9
Review items
0
False positives ignored
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to run npx to install an external skill package. This is real external command guidance from a community skill, even though it appears in Markdown.
Lines 17-26 contain a bash example with belt login and belt app run. The skill explicitly guides execution of an external CLI and remote image-generation app.
The cited context includes the inline command belt app store on line 280. It is a documented external CLI action, although limited to browsing an app store.