Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 4:42:30 PM

image-to-video security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
image-to-video
Version
v2
Maintainer
halt-catch-fire
Source
github.com/halt-catch-fire/skills/tree/main/tools/video/image-to-video/
Coverage
1 Files scanned · 246 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is a legitimate image-to-video guide, but several examples run belt commands that contact third-party inference services and upload local media. Most backtick and reconnaissance static hits are markdown formatting or model names, while actual belt and npx command examples remain confirmed medium risk.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 246 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 24 evidence locations

Capability review items (9)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 recommends running npx to install an external CLI skill. This is intentional setup guidance, but it asks users to execute third-party package code.
Medium
SKILL.md:17-32
Ruby/shell backtick execution
```bash
Lines 17-32 contain executable belt login and belt app run examples. These commands contact external inference services and process local media paths.
Medium
SKILL.md:108-139
Ruby/shell backtick execution
```bash
Lines 108-139 provide multiple belt app run commands for remote image-to-video generation. These are legitimate examples but still execute external CLI workflows.
Medium
SKILL.md:154-170
Ruby/shell backtick execution
```bash
Lines 154-170 contain belt commands that start remote jobs and merge media. These examples intentionally invoke external services and process user media.
Medium
SKILL.md:176-205
Ruby/shell backtick execution
```bash
Lines 176-205 define a full belt pipeline for image generation, animation, upscaling, audio, and media merging. The pipeline executes external commands against remote apps.
Medium
SKILL.md:215-220
Ruby/shell backtick execution
```bash
Lines 215-220 include a belt app run command for remote image-to-video generation. This is intended use, but it can submit local media to an external service.
Medium
SKILL.md:236-242
Ruby/shell backtick execution
```bash
Lines 236-242 recommend npx skills add commands for related skills. Installing external skills is a supply-chain risk unless the source is trusted.
Low
SKILL.md:11
Hardcoded URL
Convert still images to animated videos via [inference.sh](https://inference.sh) CLI.
Line 11 links to inference.sh, the external service used by the workflow. The URL is disclosed, but it confirms the skill depends on a third-party network service.
Low
SKILL.md:15
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
Line 15 links to raw GitHub install instructions for the required CLI. This is visible documentation, but it depends on external hosted setup content.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:110-138SKILL.md:156-168SKILL.md:184-203SKILL.md:216-219
Third-Party Media Upload Risk
The skill instructs belt app runs that submit image, video, and audio paths to remote inference apps. Sensitive media could be exposed if users run these examples without consent checks.
Multiple documented belt app run examples include local media path fields passed to remote model apps. This is clear external processing, although it appears disclosed and task-related.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    External command examples run third-party CLI workflows.
    Require explicit user confirmation before running belt commands, especially commands that upload local images, video, or audio.
  2. FIX-002
    Medium
    Media privacy expectations are not stated before upload examples.
    Add a clear warning that belt app runs may send media to inference.sh and model providers. Recommend sanitized or approved assets.
  3. FIX-003
    Low
    npx installation guidance depends on external packages and skills.
    Pin trusted sources or direct users to verified installation documentation before suggesting npx skill installation commands.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable