No prompt injection or malicious intent was found in SKILL.md. The main risks are expected external belt CLI execution, hosted image processing, mutable install guidance, and one remote embedded image asset. Several static findings are Markdown fence or placeholder URL false positives.
Remote Image Processing Sends User Data Off Device
The skill routes image URLs and edit prompts through hosted inference.sh and falai apps. Users may expose private photos, product images, or generated assets to external services.
Multiple documented workflows call belt app run with image URLs and prompts for hosted image services. This is intended functionality, but the privacy boundary is clear from the commands.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to install an external CLI skill. This is legitimate setup guidance, but it creates supply-chain risk if followed without verification.
The code block instructs belt login and belt app run commands that call a hosted inference app with an image URL. This is expected behavior, but it executes an external CLI and sends data to a remote service.
The Markdown image embeds a remote asset from cloud.inference.sh, which can trigger network loading in rendered views. The asset is relevant, but it creates a third-party content dependency.
The install instructions link points to a raw GitHub URL on a mutable main branch. Users may follow changing remote installation guidance outside the reviewed skill content.
No prompt injection or malicious intent was found in SKILL.md. The main risks are expected external belt CLI execution, hosted image processing, mutable install guidance, and one remote embedded image asset. Several static findings are Markdown fence or placeholder URL false positives.
Remote Image Processing Sends User Data Off Device
The skill routes image URLs and edit prompts through hosted inference.sh and falai apps. Users may expose private photos, product images, or generated assets to external services.
Multiple documented workflows call belt app run with image URLs and prompts for hosted image services. This is intended functionality, but the privacy boundary is clear from the commands.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to install an external CLI skill. This is legitimate setup guidance, but it creates supply-chain risk if followed without verification.
The code block instructs belt login and belt app run commands that call a hosted inference app with an image URL. This is expected behavior, but it executes an external CLI and sends data to a remote service.
The Markdown image embeds a remote asset from cloud.inference.sh, which can trigger network loading in rendered views. The asset is relevant, but it creates a third-party content dependency.
The install instructions link points to a raw GitHub URL on a mutable main branch. Users may follow changing remote installation guidance outside the reviewed skill content.