Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 4:37:16 PM

character-design-sheet security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
character-design-sheet
Version
v3
Maintainer
halt-catch-fire
Source
github.com/halt-catch-fire/skills/tree/main/guides/design/character-design-sheet/
Coverage
1 Files scanned · 282 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is not malicious, but it depends on broad belt CLI access and third-party inference services. Real command and network findings were confirmed, while markdown diagrams, templates, and the line 207 reconnaissance hit were dismissed as false positives. Publication should require clear user confirmation for login, installs, remote app runs, and possible service costs.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 282 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 24 evidence locations

Capability review items (9)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source.
Medium
SKILL.md:17-26
Ruby/shell backtick execution
```bash
The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service.
Medium
SKILL.md:58-92
Ruby/shell backtick execution
```bash
This bash block runs several belt app run commands and a stitch-images job. The commands are fixed examples, but they still invoke external processing through the belt CLI.
Medium
SKILL.md:110-133
Ruby/shell backtick execution
```bash
The expression sheet example contains belt app run commands for remote image generation. There is no command injection evidence, but the external CLI execution risk is real.
Medium
SKILL.md:204-210
Ruby/shell backtick execution
```bash
The LoRA example invokes belt app run with a local LoRA path and remote model. This can transmit prompt and file reference data to an external inference workflow.
Medium
SKILL.md:274-278
Ruby/shell backtick execution
```bash
The related skills block provides npx skills add commands for additional external skill installs. They are optional documentation, but they remain shell commands that fetch external content.
Medium
SKILL.md:278-280
Ruby/shell backtick execution
```
The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use.
Low
SKILL.md:11
Hardcoded URL
Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc
Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing.
Low
SKILL.md:15
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:4SKILL.md:18-21
Overbroad Belt CLI Permission
The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.
The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Broad Bash(belt *) permission
    Narrow allowed tools to required belt subcommands, or require explicit confirmation before login, app listing, and remote job execution.
  2. FIX-002
    Medium
    Third-party inference execution
    Tell users before execution that prompts, image references, and LoRA paths may be sent to inference.sh or model providers.
  3. FIX-003
    Medium
    External installation recommendations
    Keep npx skill-install commands as optional manual steps, and avoid asking agents to execute them automatically.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable