📦
Audit History
storyboard-creation - 3 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 3 Latest
Jul 5, 2026, 03:06 PM
The main static alerts are Markdown code fences and inline code, with many false positives. Several cited sections do provide real belt or npx commands, and the skill has an intentional external image-generation dependency that can send storyboard prompts or image references to third-party services.
1
Files scanned
270
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Third-Party Prompt and Image Processing
The workflow sends storyboard prompts and image references to external inference.sh and FAL apps through the belt CLI. Users could expose unpublished scripts, client concepts, or generated image assets to third-party services.
The skill explicitly describes AI image generation through inference.sh and provides belt app run examples with storyboard prompts and image stitching inputs. The behavior appears intended and useful, but it creates a clear third-party data exposure concern.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to install a CLI skill through npx, which can execute package-managed code and fetch dependencies. This is setup guidance, but it is still a real external command risk.
Medium
Ruby/shell backtick execution · 5 occurrences
```bash
Lines 17-32 contain bash examples for belt login and belt app run against external apps. The commands are intentional, but they execute an external CLI and send inputs outside the local environment.
Medium
Ruby/shell backtick execution
```
This range includes the inline belt app store command after the closing fence. It is a low-complexity command, but it still invokes the external belt CLI.
Low
Hardcoded URL
Create visual storyboards with AI image generation via [inference.sh](https://inference.sh) CLI.
Line 11 hardcodes the inference.sh provider URL, and the skill is designed around that external service. This is an expected network dependency, but users should know prompts may leave the local environment.
Low
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
Line 15 links to raw GitHub install instructions for the belt CLI. It is documentation rather than automatic access, but it is still an external setup dependency.
Risk Factors
⚙️ External commands (22)
SKILL.md:7 SKILL.md:15 SKILL.md:17-32 SKILL.md:32-50 SKILL.md:50-71 SKILL.md:71-107 SKILL.md:107-115 SKILL.md:115-123 SKILL.md:123-127 SKILL.md:127-133 SKILL.md:133-136 SKILL.md:136-157 SKILL.md:157-172 SKILL.md:172-180 SKILL.md:180-190 SKILL.md:190-196 SKILL.md:196-217 SKILL.md:217-221 SKILL.md:221-238 SKILL.md:238-261 SKILL.md:261-266 SKILL.md:266-268
🌐 Network access (2)
Audited by: codex
Jul 5, 2026, 03:06 PM
The main static alerts are Markdown code fences and inline code, with many false positives. Several cited sections do provide real belt or npx commands, and the skill has an intentional external image-generation dependency that can send storyboard prompts or image references to third-party services.
1
Files scanned
270
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Third-Party Prompt and Image Processing
The workflow sends storyboard prompts and image references to external inference.sh and FAL apps through the belt CLI. Users could expose unpublished scripts, client concepts, or generated image assets to third-party services.
The skill explicitly describes AI image generation through inference.sh and provides belt app run examples with storyboard prompts and image stitching inputs. The behavior appears intended and useful, but it creates a clear third-party data exposure concern.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 instructs users to install a CLI skill through npx, which can execute package-managed code and fetch dependencies. This is setup guidance, but it is still a real external command risk.
Medium
Ruby/shell backtick execution · 5 occurrences
```bash
Lines 17-32 contain bash examples for belt login and belt app run against external apps. The commands are intentional, but they execute an external CLI and send inputs outside the local environment.
Medium
Ruby/shell backtick execution
```
This range includes the inline belt app store command after the closing fence. It is a low-complexity command, but it still invokes the external belt CLI.
Low
Hardcoded URL
Create visual storyboards with AI image generation via [inference.sh](https://inference.sh) CLI.
Line 11 hardcodes the inference.sh provider URL, and the skill is designed around that external service. This is an expected network dependency, but users should know prompts may leave the local environment.
Low
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
Line 15 links to raw GitHub install instructions for the belt CLI. It is documentation rather than automatic access, but it is still an external setup dependency.
Risk Factors
⚙️ External commands (22)
SKILL.md:7 SKILL.md:15 SKILL.md:17-32 SKILL.md:32-50 SKILL.md:50-71 SKILL.md:71-107 SKILL.md:107-115 SKILL.md:115-123 SKILL.md:123-127 SKILL.md:127-133 SKILL.md:133-136 SKILL.md:136-157 SKILL.md:157-172 SKILL.md:172-180 SKILL.md:180-190 SKILL.md:190-196 SKILL.md:196-217 SKILL.md:217-221 SKILL.md:221-238 SKILL.md:238-261 SKILL.md:261-266 SKILL.md:266-268
🌐 Network access (2)
Audited by: codex
Jul 3, 2026, 01:12 PM
Static backtick findings are false positives caused by Markdown command examples, code fences, and inline CLI names. The skill is transparent about using the `belt` CLI, but its wildcard `Bash(belt *)` permission creates a broader execution surface than the documented workflow needs.
1
Files scanned
270
Lines analyzed
3
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Broad External CLI Permission
The skill declares `Bash(belt *)`, which permits any `belt` subcommand during skill use. The workflow needs the CLI, but a narrower command allowlist would reduce unintended network or account actions.
The wildcard tool permission is directly declared on line 4 and applies to a network-enabled CLI. No malicious command is shown, so the concern is permission scope rather than hostile intent.
Risk Factors
⚙️ External commands (22)
SKILL.md:7 SKILL.md:15 SKILL.md:17-32 SKILL.md:32-50 SKILL.md:50-71 SKILL.md:71-107 SKILL.md:107-115 SKILL.md:115-123 SKILL.md:123-127 SKILL.md:127-133 SKILL.md:133-136 SKILL.md:136-157 SKILL.md:157-172 SKILL.md:172-180 SKILL.md:180-190 SKILL.md:190-196 SKILL.md:196-217 SKILL.md:217-221 SKILL.md:221-238 SKILL.md:238-261 SKILL.md:261-266 SKILL.md:266-268
🌐 Network access (2)
Audited by: codex