📦
Audit History
ai-avatar-video - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 4 Latest
Jul 7, 2026, 05:48 AM
Review found no prompt-injection text or hidden malicious instructions in SKILL.md. Many static backtick and URL hits are Markdown formatting, model identifiers, placeholders, or documentation links. The remaining concerns are intentional use of the belt CLI for remote media processing and optional installation of additional third-party skills.
1
Files scanned
268
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Third-Party Processing of Likeness and Voice Data
The skill workflows submit portrait images, scripts, audio, or video URLs to inference.sh applications through belt. This can expose personal likeness, voice, or unpublished media to external processors if used with sensitive content.
Multiple command examples send image, audio, video, and voice_script values to remote inference apps. The behavior is core to the skill, so the privacy risk is clear but not malicious.
Medium
Additional Third-Party Skill Installation Guidance
The skill recommends npx skills add commands for related skills. This can expand the installed tool surface beyond the reviewed file and should require explicit user approval.
The cited lines directly recommend installing CLI or skill packages from outside the current skill. The risk is supply-chain expansion rather than evidence of malicious intent.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to install a third-party CLI skill, which can execute package-manager or installer behavior outside this skill. It is intentional but should require explicit user confirmation.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
This fenced example includes belt login and belt app run commands that invoke an external CLI and submit image and script inputs to a remote inference app. The commands are core behavior, not command injection.
Medium
Ruby/shell backtick execution
```
The span includes an inline belt app store command for browsing remote apps after the related-skills block. The command is low complexity, but it still invokes an external CLI.
Low
Hardcoded URL
Create AI avatars and talking head videos via [inference.sh](https://inference.sh) CLI.
The skill explicitly depends on inference.sh, so normal use involves a remote service. This is disclosed and expected, but it is still a real network dependency.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jul 7, 2026, 05:48 AM
Review found no prompt-injection text or hidden malicious instructions in SKILL.md. Many static backtick and URL hits are Markdown formatting, model identifiers, placeholders, or documentation links. The remaining concerns are intentional use of the belt CLI for remote media processing and optional installation of additional third-party skills.
1
Files scanned
268
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Third-Party Processing of Likeness and Voice Data
The skill workflows submit portrait images, scripts, audio, or video URLs to inference.sh applications through belt. This can expose personal likeness, voice, or unpublished media to external processors if used with sensitive content.
Multiple command examples send image, audio, video, and voice_script values to remote inference apps. The behavior is core to the skill, so the privacy risk is clear but not malicious.
Medium
Additional Third-Party Skill Installation Guidance
The skill recommends npx skills add commands for related skills. This can expand the installed tool surface beyond the reviewed file and should require explicit user approval.
The cited lines directly recommend installing CLI or skill packages from outside the current skill. The risk is supply-chain expansion rather than evidence of malicious intent.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
The line instructs users to run npx to install a third-party CLI skill, which can execute package-manager or installer behavior outside this skill. It is intentional but should require explicit user confirmation.
Medium
SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259
Ruby/shell backtick execution · 13 occurrences
```bash
This fenced example includes belt login and belt app run commands that invoke an external CLI and submit image and script inputs to a remote inference app. The commands are core behavior, not command injection.
Medium
Ruby/shell backtick execution
```
The span includes an inline belt app store command for browsing remote apps after the related-skills block. The command is low complexity, but it still invokes an external CLI.
Low
Hardcoded URL
Create AI avatars and talking head videos via [inference.sh](https://inference.sh) CLI.
The skill explicitly depends on inference.sh, so normal use involves a remote service. This is disclosed and expected, but it is still a real network dependency.
Low
Hardcoded URL
SKILL.md:7 SKILL.md:17 SKILL.md:19-28 SKILL.md:28-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-55 SKILL.md:55-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-80 SKILL.md:80-85 SKILL.md:85-91 SKILL.md:91-104 SKILL.md:104-108 SKILL.md:108-113 SKILL.md:113-119 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-133 SKILL.md:133-139 SKILL.md:139-152 SKILL.md:152-158 SKILL.md:158-172 SKILL.md:172-178 SKILL.md:178-194 SKILL.md:194-206 SKILL.md:206-218 SKILL.md:218-235 SKILL.md:235 SKILL.md:241-259 SKILL.md:259-261
Audited by: codex
Jun 30, 2026, 08:12 PM
Static command and network findings are mostly true positives because the skill teaches users to run belt CLI workflows against hosted inference apps. No malicious intent, prompt injection, credential theft, or weak cryptography was found; the weak-crypto alert on SKILL.md line 3 is a false positive. Publish with a warning about external processing, shell execution, account costs, and local output files.
1
Files scanned
268
Lines analyzed
6
Review items
1
False positives ignored
Confirmed security concerns (3)
Medium
SKILL.md:4SKILL.md:7SKILL.md:17SKILL.md:19-28SKILL.md:55-63SKILL.md:67-76SKILL.md:80-85SKILL.md:91-104SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:139-152SKILL.md:158-172SKILL.md:178-194SKILL.md:206-218SKILL.md:241-259SKILL.md:261
User-Triggered External CLI Execution
The skill grants Bash access for belt commands and provides many belt app run examples. This is expected for the skill, but it can spend account credits and process user media through external services.
The allowed-tools header and repeated belt examples confirm intentional command execution. The commands are documented user workflows, not hidden auto-execution or malware.
Medium
SKILL.md:11-13SKILL.md:17SKILL.md:23-27SKILL.md:55-63SKILL.md:80-85SKILL.md:108-113SKILL.md:119-124SKILL.md:128-133SKILL.md:158-172SKILL.md:206-218SKILL.md:265-267
External Hosted Media Processing
The examples send portrait images, audio, scripts, and videos to inference.sh apps and related model providers. Users should avoid sensitive personal data unless they accept those service terms.
The cited examples pass remote URLs and text inputs to hosted inference apps. No covert endpoint or credential exfiltration evidence was found.
Low
Local Output Files May Be Overwritten
Several examples redirect command output to fixed JSON filenames. This is normal workflow storage, but running them may overwrite files with the same names.
Shell redirection to fixed filenames is visible in the examples. The impact is limited because the filenames are local workflow artifacts.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
False Positive: Weak Cryptographic Algorithm
The scanner flagged SKILL.md line 3, but that line is a YAML description of avatar video features. No cryptographic algorithm or cryptographic operation is present.
Manual review of the cited line found only marketplace description text. There is no crypto code, weak hash, encryption mode, or key handling.
Risk Factors
⚙️ External commands (17)
🌐 Network access (11)
📁 Filesystem access (3)
Detected Patterns
User-Triggered External CLI ExecutionExternal Hosted Media ProcessingLocal Output Files May Be Overwritten
Audited by: codex
May 29, 2026, 09:22 AM
This is a documentation-only skill (SKILL.md) describing how to use the inference.sh belt CLI for AI avatar video generation. All static findings are false positives: the weak crypto flag was triggered by YAML frontmatter, and the backtick executions are markdown code fence delimiters in documentation examples, not actual code execution. The hardcoded URLs are legitimate inference.sh service endpoints and documentation links.
1
Files scanned
268
Lines analyzed
1
Review items
0
False positives ignored
Risk Factors
🌐 Network access (5)
Audited by: claude