Versioned security assessment

Report ID: SA-F93E9BB0

7/7/2026, 5:48:06 AM

ai-avatar-video security assessment v3

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: ai-avatar-video
Version: v3
Maintainer: skills-shell
Source: github.com/skills-shell/skills/tree/main/tools/video/ai-avatar-video/
Coverage: 1 Files scanned · 268 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Review found no prompt-injection text or hidden malicious instructions in SKILL.md. Many static backtick and URL hits are Markdown formatting, model identifiers, placeholders, or documentation links. The remaining concerns are intentional use of the belt CLI for remote media processing and optional installation of additional third-party skills.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 268 Lines analyzed

19 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 21 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 33 evidence locations

Capability review items (17)

Medium

SKILL.md:7

Ruby/shell backtick execution

> **Install the belt CLI skill:** `npx skills add belt-sh/cli`

The line instructs users to run npx to install a third-party CLI skill, which can execute package-manager or installer behavior outside this skill. It is intentional but should require explicit user confirmation.

Medium

SKILL.md:19-28

Ruby/shell backtick execution

```bash

This fenced example includes belt login and belt app run commands that invoke an external CLI and submit image and script inputs to a remote inference app. The commands are core behavior, not command injection.

Medium

SKILL.md:55-63

Ruby/shell backtick execution

```bash

This example runs belt app run for P-Video-Avatar and sends portrait and script inputs to a remote model service. It is legitimate skill behavior but still external command execution.

Medium

SKILL.md:67-76

Ruby/shell backtick execution

```bash

This example runs belt app run with prompt-controlled avatar settings against a remote inference app. The risk is intentional external CLI execution, not shell metacharacter injection.

Medium

SKILL.md:80-85

Ruby/shell backtick execution

```bash

This example runs belt app run with an image and audio input for remote avatar generation. It requires external command execution and networked media processing.

Medium

SKILL.md:91-104

Ruby/shell backtick execution

```bash

This workflow runs belt app run for both image generation and avatar generation. It chains external model calls through the CLI and should require user approval.

Medium

SKILL.md:108-113

Ruby/shell backtick execution

```bash

This example runs belt app run for OmniHuman with image and audio URLs. It is an intentional remote CLI invocation that processes user media.

Medium

SKILL.md:119-124

Ruby/shell backtick execution

```bash

This example runs belt app run for Fabric with image and audio URLs. It is an intentional external command that submits media to a remote model provider.

Medium

SKILL.md:128-133

Ruby/shell backtick execution

```bash

This example runs belt app run for PixVerse Lipsync with image and audio URLs. It is legitimate but still sends media through an external CLI.

Medium

SKILL.md:139-152

Ruby/shell backtick execution

```bash

This workflow runs belt app run for TTS and avatar generation and redirects model output to a local file. It combines external command execution, remote processing, and local output writes.

Medium

SKILL.md:158-172

Ruby/shell backtick execution

```bash

This dubbing workflow runs multiple belt app run commands for transcription, speech generation, and lip sync while writing JSON outputs locally. It is intentional but has command, network, and data handling exposure.

Medium

SKILL.md:178-194

Ruby/shell backtick execution

```bash

This UGC workflow runs belt app run for portrait generation and avatar video generation. The commands intentionally call remote model services with likeness and script inputs.

Medium

SKILL.md:206-218

Ruby/shell backtick execution

```bash

This batch example loops over several voices and repeatedly invokes belt app run. The loop uses a fixed voice list, but it still automates repeated external command execution.

Medium

SKILL.md:241-259

Ruby/shell backtick execution

```bash

This related-skills block recommends npx skills add commands that can install additional third-party skills. That expands the trusted execution surface beyond the reviewed skill.

Medium

SKILL.md:259-261

Ruby/shell backtick execution

```

The span includes an inline belt app store command for browsing remote apps after the related-skills block. The command is low complexity, but it still invokes an external CLI.

Low

SKILL.md:11

Hardcoded URL

Create AI avatars and talking head videos via [inference.sh](https://inference.sh) CLI.

The skill explicitly depends on inference.sh, so normal use involves a remote service. This is disclosed and expected, but it is still a real network dependency.

Low

SKILL.md:13

Hardcoded URL

![AI Avatar & Talking Head Videos](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr

The Markdown embeds an image from cloud.inference.sh, which renderers may fetch externally. This is low risk but can expose basic request metadata to the image host.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium

SKILL.md:23-27 SKILL.md:80-84 SKILL.md:158-171

Third-Party Processing of Likeness and Voice Data

The skill workflows submit portrait images, scripts, audio, or video URLs to inference.sh applications through belt. This can expose personal likeness, voice, or unpublished media to external processors if used with sensitive content.

Multiple command examples send image, audio, video, and voice_script values to remote inference apps. The behavior is core to the skill, so the privacy risk is clear but not malicious.

RISK-002 Medium

SKILL.md:7 SKILL.md:241-258

Additional Third-Party Skill Installation Guidance

The skill recommends npx skills add commands for related skills. This can expand the installed tool surface beyond the reviewed file and should require explicit user approval.

The cited lines directly recommend installing CLI or skill packages from outside the current skill. The risk is supply-chain expansion rather than evidence of malicious intent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Medium
Remote processing of user media

Add a clear warning before examples that portrait, voice, script, audio, and video inputs may be sent to external inference providers.
FIX-002
Medium
Third-party skill installation commands

Require explicit user confirmation before npx skills add commands and document trusted sources or pinned refs for related skills.
FIX-003
Low
Command execution expectations

State that belt login, belt app run, and belt app store commands should run only after reviewing inputs and expected costs.
FIX-004
Low
Placeholder media URLs

Use neutral placeholders such as your-image-url and remind users not to use media without rights or consent.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable