The skill contains genuine external command and network behavior through documented belt and npx workflows. Most static backtick matches are Markdown fences or model identifiers, but command examples, third-party installation, remote image loading, and external media processing remain relevant risks.
The examples submit portrait, audio, and video references to hosted inference services. Users may expose personal, biometric, copyrighted, or confidential media.
The cited belt examples explicitly pass remote portrait, audio, and video URLs to hosted model applications.
Capability review items (20)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The static alerts are Markdown formatting, example commands, placeholder URLs, and documentation links rather than Ruby backtick execution or hidden callbacks. I added semantic findings for shell quoting risk in command examples and for remote processing privacy disclosure. No evidence found of prompt injection or malicious command intent.
Several examples pass request data directly in shell arguments. If an assistant inserts a user prompt or URL containing a single quote without escaping, the shell could parse unintended tokens before belt receives the request.
The examples show shell-quoted request bodies, and the skill is intended to adapt them to user prompts. The risk depends on future interpolation behavior, so confidence is medium.
Remote Media Processing Requires Privacy Disclosure
The skill sends prompts and user media URLs to inference.sh video apps for generation, avatar, lipsync, upscaling, foley, and merging. This is the advertised feature, but users need a privacy warning before using sensitive media.
The skill clearly documents remote CLI use and URL-based media inputs. I found no covert exfiltration, so severity stays low.
The static alerts are Markdown formatting, example commands, placeholder URLs, and documentation links rather than Ruby backtick execution or hidden callbacks. I added semantic findings for shell quoting risk in command examples and for remote processing privacy disclosure. No evidence found of prompt injection or malicious command intent.
Several examples pass request data directly in shell arguments. If an assistant inserts a user prompt or URL containing a single quote without escaping, the shell could parse unintended tokens before belt receives the request.
The examples show shell-quoted request bodies, and the skill is intended to adapt them to user prompts. The risk depends on future interpolation behavior, so confidence is medium.
Remote Media Processing Requires Privacy Disclosure
The skill sends prompts and user media URLs to inference.sh video apps for generation, avatar, lipsync, upscaling, foley, and merging. This is the advertised feature, but users need a privacy warning before using sensitive media.
The skill clearly documents remote CLI use and URL-based media inputs. I found no covert exfiltration, so severity stays low.
Static analysis found many command and URL patterns plus two weak cryptography alerts. Review confirms the command patterns are legitimate belt and npx examples, but they create real third-party network and account-credit exposure. The weak cryptography alerts are false positives from descriptive text, and no prompt injection or malicious exfiltration intent was found.
Networked CLI Execution Sends User Content to Third-Party Services
The skill permits Bash use for belt and repeatedly instructs users to run belt app commands with prompts, image URLs, audio URLs, and video URLs. This is expected for AI video generation, but it can transmit user-provided media and text to inference.sh hosted models and may consume account credits.
The file explicitly grants Bash access to belt and shows concrete belt app run commands with remote media URLs. The behavior is legitimate for the skill purpose, but the data and billing exposure are real.
The related skills section gives npx skills add commands that install additional skills from a remote repository. These commands are documentation examples rather than allowed tool permissions, but following them expands trusted code and should be reviewed before use.
The npx install commands are directly present and target remote skill packages. Risk is moderated because they are examples and the skill metadata only allows Bash(belt *).
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static analysis reported weak cryptography at the frontmatter description and a table header. No cryptographic API, hash function, encryption routine, key material, or authentication logic appears at those locations.
Manual review of both lines shows descriptive marketplace text and a Markdown table header only. There is no code path that performs cryptography.
Hardcoded URLs Are Documentation and Placeholder Media References
The hardcoded URL findings point to the inference.sh site, an image asset, install instructions, documentation links, and placeholder media URLs. They are not evidence of covert exfiltration, but users should understand that real media URLs sent to belt are processed remotely.
The URLs are visible documentation links and example inputs aligned with the skill purpose. No hidden endpoint, credential transfer, or obfuscation was found.
All static analysis findings are false positives. The skill provides legitimate AI video generation documentation using the belt CLI tool. The analyzer incorrectly flagged markdown backticks as Ruby shell execution and misidentified 'Seedance' (an AI model name) as weak cryptographic code. Network and external command flags represent expected behavior for a CLI wrapper skill.
1
Files scanned
186
Lines analyzed
3
Review items
2
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill contains URLs to inference.sh services and documentation. These are legitimate service endpoints required for the skill's functionality. No credential exfiltration or unauthorized data transmission detected.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static analyzer flagged SKILL.md:3 and :63 as containing weak cryptographic algorithms. This is incorrect - the analyzer detected 'Seedance' (a ByteDance AI video model name) and misinterpreted table formatting as code. No cryptographic code exists in this file.
Static analyzer flagged multiple lines as Ruby shell execution with backticks. This is incorrect - the detected backticks are markdown code formatting syntax used throughout the documentation for inline code. No Ruby shell execution exists in this file.