📦
Audit History
product-photography - 3 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 3 Latest
Jul 5, 2026, 02:49 PM
The confirmed findings are manual npx installation commands and belt CLI examples that can run external commands or send image data to remote services. Many other static hits are Markdown fence delimiters or inline documentation links, and no prompt injection attempt was found in SKILL.md.
1
Files scanned
294
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Broad Belt CLI Permission
The skill frontmatter grants Bash(belt *), which permits any belt subcommand rather than only the documented generation commands. This broad scope increases impact if unsafe instructions cause unintended belt operations.
The allowed-tools declaration is explicit and broader than the documented examples. It is a permission-scope issue, not evidence of hidden malicious intent.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The cited Markdown tells users to run npx skills add for additional tooling. It is manual, but it introduces supply-chain risk from third-party packages.
Medium
SKILL.md:17-25SKILL.md:34-39SKILL.md:52-58SKILL.md:71-76SKILL.md:82-88SKILL.md:94-99SKILL.md:105-110SKILL.md:180-206SKILL.md:252-269SKILL.md:286-290
Ruby/shell backtick execution · 10 occurrences
```bash
The fenced example runs belt app commands against remote image generation services. The arguments are static examples, but following them invokes external commands with network side effects.
Medium
Ruby/shell backtick execution
```
The surrounding lines include inline guidance to run belt app store. It is a manual command, but it still invokes an external CLI and may access a remote app catalog.
Risk Factors
⚙️ External commands (32)
SKILL.md:7 SKILL.md:15 SKILL.md:17-25 SKILL.md:25-34 SKILL.md:34-39 SKILL.md:39-52 SKILL.md:52-58 SKILL.md:58-71 SKILL.md:71-76 SKILL.md:76-82 SKILL.md:82-88 SKILL.md:88-94 SKILL.md:94-99 SKILL.md:99-105 SKILL.md:105-110 SKILL.md:110-180 SKILL.md:180-206 SKILL.md:206-212 SKILL.md:212-216 SKILL.md:216-220 SKILL.md:220-224 SKILL.md:224-228 SKILL.md:228-232 SKILL.md:232-236 SKILL.md:236-240 SKILL.md:240-244 SKILL.md:244-248 SKILL.md:248-252 SKILL.md:252-269 SKILL.md:269-286 SKILL.md:286-290 SKILL.md:290-292
🌐 Network access (2)
Audited by: codex
Jul 5, 2026, 02:49 PM
The confirmed findings are manual npx installation commands and belt CLI examples that can run external commands or send image data to remote services. Many other static hits are Markdown fence delimiters or inline documentation links, and no prompt injection attempt was found in SKILL.md.
1
Files scanned
294
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Broad Belt CLI Permission
The skill frontmatter grants Bash(belt *), which permits any belt subcommand rather than only the documented generation commands. This broad scope increases impact if unsafe instructions cause unintended belt operations.
The allowed-tools declaration is explicit and broader than the documented examples. It is a permission-scope issue, not evidence of hidden malicious intent.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The cited Markdown tells users to run npx skills add for additional tooling. It is manual, but it introduces supply-chain risk from third-party packages.
Medium
SKILL.md:17-25SKILL.md:34-39SKILL.md:52-58SKILL.md:71-76SKILL.md:82-88SKILL.md:94-99SKILL.md:105-110SKILL.md:180-206SKILL.md:252-269SKILL.md:286-290
Ruby/shell backtick execution · 10 occurrences
```bash
The fenced example runs belt app commands against remote image generation services. The arguments are static examples, but following them invokes external commands with network side effects.
Medium
Ruby/shell backtick execution
```
The surrounding lines include inline guidance to run belt app store. It is a manual command, but it still invokes an external CLI and may access a remote app catalog.
Risk Factors
⚙️ External commands (32)
SKILL.md:7 SKILL.md:15 SKILL.md:17-25 SKILL.md:25-34 SKILL.md:34-39 SKILL.md:39-52 SKILL.md:52-58 SKILL.md:58-71 SKILL.md:71-76 SKILL.md:76-82 SKILL.md:82-88 SKILL.md:88-94 SKILL.md:94-99 SKILL.md:99-105 SKILL.md:105-110 SKILL.md:110-180 SKILL.md:180-206 SKILL.md:206-212 SKILL.md:212-216 SKILL.md:216-220 SKILL.md:220-224 SKILL.md:224-228 SKILL.md:228-232 SKILL.md:232-236 SKILL.md:236-240 SKILL.md:240-244 SKILL.md:244-248 SKILL.md:248-252 SKILL.md:252-269 SKILL.md:269-286 SKILL.md:286-290 SKILL.md:290-292
🌐 Network access (2)
Audited by: codex
Jul 3, 2026, 01:13 PM
The skill is a product photography guide that intentionally relies on the belt CLI and external image-generation services. Most static hits are Markdown fence false positives, but real CLI execution, external install commands, hardcoded service links, and possible upload of local product images remain relevant risks.
1
Files scanned
294
Lines analyzed
16
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Potential Upload of Proprietary Product Images
The image editing and upscaling workflow passes local image filenames to belt app run. If belt uploads those files to external model services, users may expose unreleased product imagery or brand assets.
The cited workflow uses image inputs with an external CLI-backed model app. The file upload behavior is inferred from the image-to-image and upscaler commands, so confidence is high but not absolute.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to install an external CLI skill. This is a real external command dependency, even though it is documented rather than hidden.
Medium
SKILL.md:17-25SKILL.md:34-39SKILL.md:52-58SKILL.md:71-76SKILL.md:82-88SKILL.md:94-99SKILL.md:105-110SKILL.md:180-206SKILL.md:252-269SKILL.md:286-290
Ruby/shell backtick execution · 10 occurrences
```bash
The bash block runs belt login and belt app run against an external image model. This can execute a local CLI and transmit prompt content to a third-party service.
Low
Hardcoded URL
Create professional product images with AI via [inference.sh](https://inference.sh) CLI.
The skill explicitly depends on inference.sh as an external service. This is a legitimate product link, but users should know prompts and generated assets may leave their environment.
Low
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The skill links to raw GitHub install instructions for the required CLI. This is an external network dependency and supply-chain touchpoint.
Risk Factors
⚙️ External commands (32)
SKILL.md:7 SKILL.md:15 SKILL.md:17-25 SKILL.md:25-34 SKILL.md:34-39 SKILL.md:39-52 SKILL.md:52-58 SKILL.md:58-71 SKILL.md:71-76 SKILL.md:76-82 SKILL.md:82-88 SKILL.md:88-94 SKILL.md:94-99 SKILL.md:99-105 SKILL.md:105-110 SKILL.md:110-180 SKILL.md:180-206 SKILL.md:206-212 SKILL.md:212-216 SKILL.md:216-220 SKILL.md:220-224 SKILL.md:224-228 SKILL.md:228-232 SKILL.md:232-236 SKILL.md:236-240 SKILL.md:240-244 SKILL.md:244-248 SKILL.md:248-252 SKILL.md:252-269 SKILL.md:269-286 SKILL.md:286-290 SKILL.md:290-292
🌐 Network access (2)
Audited by: codex