Most static alerts are false positives caused by Markdown backticks, fixed CLI examples, public links, and an image parameter name. The unpinned npx skill installations are genuine supply-chain risks, and reference-image editing sends user data to an external processor.
The editing workflow submits reference-image URLs through inference.sh model execution. Sensitive or access-controlled images could be disclosed to the external processor.
The example explicitly places three image URLs in reference_images for a belt app run. External processing is the stated function, although service retention is not documented here.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This command invokes an unpinned npx package to install a separate community skill. Executing mutable third-party installer content creates a supply-chain risk.
These npx commands install several external skills without versions or immutable revisions. Their future contents can change and execute with the agent's granted capabilities.
I found no evidence of malicious intent, prompt injection, credential collection, or hidden code execution in SKILL.md. The static findings are false positives from Markdown code fences, inline backticks, placeholder URLs, and the term negative_prompt.
I found no evidence of malicious intent, prompt injection, credential collection, or hidden code execution in SKILL.md. The static findings are false positives from Markdown code fences, inline backticks, placeholder URLs, and the term negative_prompt.
Static analysis found many command and URL patterns, but the reviewed file is a documentation skill that calls the inference.sh CLI for its intended image workflow. The high weak-cryptography alerts appear to be false positives from model names, version-like text, and option tables, with no cryptographic implementation found. Publication is acceptable with warnings because prompts and reference image URLs are sent to an external inference service through CLI commands.
1
Files scanned
185
Lines analyzed
5
Review items
2
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill grants Bash access to infsh and repeatedly instructs users to run infsh app commands. This is expected behavior for the skill, but it executes an external CLI and sends prompts or image references to a third-party service.
The frontmatter explicitly allows Bash(infsh *), and examples show infsh app run commands. The risk is confirmed, but it matches the stated image generation purpose.
The workflow depends on inference.sh documentation and cloud execution, and the image editing example accepts remote reference image URLs. Users may expose sensitive prompts or image URLs to the external service.
The reviewed text contains explicit inference.sh links and reference_images URI fields. There is no evidence of covert exfiltration, but external data transfer is part of normal operation.
The command examples embed JSON inside shell arguments. This is normal CLI documentation, but agents should escape user-supplied prompt text before placing it in shell commands.
The examples use static prompts and are not directly vulnerable as written. Risk appears if an assistant interpolates unescaped user text into the shell command.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Weak-Cryptography Alerts Are False Positives
The reported weak cryptography locations correspond to descriptive text, model names, option tables, or metadata fields. No hashing, encryption, signing, or insecure cryptographic API usage was found in SKILL.md.
Manual review found documentation content at the flagged lines, not cryptographic code. The static pattern likely matched version-like or table text.
All 53 static analysis findings are false positives. The detected 'Ruby/shell backtick execution' patterns are markdown code fences in documentation, not executable code. Hardcoded URLs are legitimate service and documentation links for inference.sh integration. No actual security risks present - this is a documentation-only skill providing CLI usage examples.
1
Files scanned
185
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static scanner flagged 8 hardcoded URLs as potential network risks. These are legitimate documentation and service URLs for inference.sh integration, not exfiltration endpoints.
URLs point to legitimate inference.sh documentation and example.com placeholders in code samples - no evidence of malicious data transfer