Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 4:37:16 PM

character-design-sheet security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
character-design-sheet
Version
v4
Maintainer
halt-catch-fire
Source
github.com/halt-catch-fire/skills/tree/main/guides/design/character-design-sheet/
Coverage
1 Files scanned · 282 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is not malicious, but it depends on broad belt CLI access and third-party inference services. Real command and network findings were confirmed, while markdown diagrams, templates, and the line 207 reconnaissance hit were dismissed as false positives. Publication should require clear user confirmation for login, installs, remote app runs, and possible service costs.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 282 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 24 evidence locations

Capability review items (9)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 gives an npx command to install another CLI skill, which is real external command execution. It is transparent setup guidance, but it still asks users to run code from an external package source.
Medium
SKILL.md:17-26
Ruby/shell backtick execution
```bash
The quick start runs belt login and belt app run against a remote image model. This is intended behavior, but it executes an external CLI and may send prompt data to a third-party service.
Medium
SKILL.md:58-92
Ruby/shell backtick execution
```bash
This bash block runs several belt app run commands and a stitch-images job. The commands are fixed examples, but they still invoke external processing through the belt CLI.
Medium
SKILL.md:110-133
Ruby/shell backtick execution
```bash
The expression sheet example contains belt app run commands for remote image generation. There is no command injection evidence, but the external CLI execution risk is real.
Medium
SKILL.md:204-210
Ruby/shell backtick execution
```bash
The LoRA example invokes belt app run with a local LoRA path and remote model. This can transmit prompt and file reference data to an external inference workflow.
Medium
SKILL.md:274-278
Ruby/shell backtick execution
```bash
The related skills block provides npx skills add commands for additional external skill installs. They are optional documentation, but they remain shell commands that fetch external content.
Medium
SKILL.md:278-280
Ruby/shell backtick execution
```
The range includes the belt app store command, which uses the permitted external CLI to browse remote apps. The risk is low in intent but still involves external command and network use.
Low
SKILL.md:11
Hardcoded URL
Create consistent characters across multiple AI-generated images via [inference.sh](https://inferenc
Line 11 identifies inference.sh as the external service used for image generation. This is disclosed, but it confirms the skill depends on third-party network processing.
Low
SKILL.md:15
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
Line 15 links to GitHub-hosted install instructions for the required CLI. This is transparent setup documentation, but it is still a hardcoded external dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:4SKILL.md:18-21
Overbroad Belt CLI Permission
The skill allows Bash(belt *) and then asks users to log in and run remote inference commands. This grants broad access to belt subcommands beyond the listed image examples.
The allowed-tools declaration permits every belt subcommand, and the quick start uses account login and app execution. No malicious intent appears, but the permission scope is broader than needed.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Broad Bash(belt *) permission
    Narrow allowed tools to required belt subcommands, or require explicit confirmation before login, app listing, and remote job execution.
  2. FIX-002
    Medium
    Third-party inference execution
    Tell users before execution that prompts, image references, and LoRA paths may be sent to inference.sh or model providers.
  3. FIX-003
    Medium
    External installation recommendations
    Keep npx skill-install commands as optional manual steps, and avoid asking agents to execute them automatically.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
a06681402992ceae98ba04d54cfd4ab004862696
Content hash
fd0a5ba0fc283889deccc46ea4937ee4f6205d1e8411bb3ccf0acdd7e40f7db8
Tree hash
b0cdf688320ebae4a1363eebe7d668da1dd695ef50450c1695e2176905e0ca00
Skill path
skills/halt-catch-fire/character-design-sheet
Audit payload hash
6cc0eedb8abc3cbb1753c8c211b201d4

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable