Versioned security assessment

Report ID: SA-4121DE96

8/6/2026, 10:46:49 AM

p-image security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
p-image
Version
v5
Maintainer
inferen-sh
Source
github.com/inferen-sh/skills/tree/main/tools/image/p-image/
Coverage
1 Files scanned · 141 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static detections are Markdown backticks, fenced examples, or documentation links and are false positives. Unpinned skill installation commands and remote image loading remain real risks. The command templates also require safeguards against shell injection and disclosure of sensitive prompts or image URLs.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 141 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 26 evidence locations

Capability review items (4)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
Line 7 directs users to run an unpinned npx installer that can download executable code and add a third-party skill. This creates a supply-chain risk.
Medium
SKILL.md:119-131
Ruby/shell backtick execution
```bash
This block directs users to run several unpinned npx skill installers from remote repositories. Mutable dependencies can introduce unreviewed instructions or code.
Low
SKILL.md:13
Hardcoded URL
![P-Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kkgym0yqys
The embedded Markdown image can trigger an automatic request to cloud.inference.sh when the skill is rendered. That request exposes viewer network metadata to the remote host.
Low
SKILL.md:17
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The installation link targets a mutable raw file on the main branch. Its instructions can change after review and influence users to execute new installation steps.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
SKILL.md:41-45SKILL.md:52-56SKILL.md:63-67SKILL.md:72-76SKILL.md:81-85
Shell Injection Through Prompt Interpolation
Examples place prompts and image URLs inside single-quoted shell arguments. Unescaped user input can terminate quoting and append commands.
The examples establish a repeatable shell template where user-supplied prompts or URLs replace literals. Single quotes inside those values would break the shown quoting boundary.
RISK-002 Medium
SKILL.md:19-22SKILL.md:63-76
Remote Submission of User Content
The belt commands send prompts and referenced image URLs to hosted Pruna applications, potentially exposing sensitive content to an external service.
The skill states that belt uses inference.sh and the commands submit prompts and image references to hosted app identifiers. Remote processing is the documented purpose.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Prompt text and image URLs may be inserted into single-quoted shell arguments.
    Require shell-safe JSON serialization and prohibit raw concatenation of user values into command strings.
  2. FIX-002
    Medium
    The skill recommends unpinned npx installation commands.
    Pin installers and referenced skills to reviewed immutable versions or commits, and document the exact source.
  3. FIX-003
    Medium
    Image prompts and source URLs are submitted to a hosted inference service.
    Warn users before transmission and advise them to exclude secrets, private URLs, and regulated content.
  4. FIX-004
    Low
    The Markdown preview loads an image from a remote inference.sh host.
    Bundle a reviewed local image or document that previews may contact the remote host.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
4121de961d1b6f2ffca856260e239505c302452c
Content hash
215b15db2fddf4189a9a1dd395576d4b30880dcfccd443e14cef899e8c645b83
Tree hash
f528b3468fc6ec7b4b5f47e94d04996a1503071fd0ad7ae8673d2021c0096130
Skill path
skills/inferen-sh/p-image
Audit payload hash
51a3bd4a428c72d8f70df52e3fef95ff

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active