📦
Audit History
ai-image-generation - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Jul 9, 2026, 11:36 AM | 3 confirmed | 0 | No capability change |
| v5 | Jul 9, 2026, 11:36 AM | 3 confirmed | 0 | No capability change |
| v4 | Jul 7, 2026, 05:53 AM | No confirmed findings | 20 | No capability change |
| v3 | Jun 30, 2026, 08:15 PM | No confirmed findings | 2 | No capability change |
| v2 | Jun 30, 2026, 08:15 PM | No confirmed findings | 2 | No capability change |
| v1 | May 21, 2026, 09:19 AM | No confirmed findings | 2 | Baseline |
Audit version 6 Latest
Jul 9, 2026, 11:36 AM
The static Ruby backtick and hardcoded URL findings are mostly Markdown false positives, and I found no hidden executable code in SKILL.md. The remaining concerns are contextual: broad belt CLI permission, unpinned remote skill installation guidance, and user content being sent to external image services.
1
Files scanned
172
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
Broad Belt CLI Permission Surface
The frontmatter permits Bash(belt *), so the assistant may invoke any belt subcommand. This is broader than the documented image workflow and can allow unintended account, file, or network operations through the CLI.
The broad tool permission is explicit in the skill frontmatter. The exact impact depends on the installed belt CLI subcommands, so the confidence is high but not critical.
Medium
Unpinned Remote Skill Installation Guidance
The skill recommends npx skills add for belt-sh/cli and several inference-sh/skills entries without pinning reviewed versions. Users who follow it may install remote skill content that changes after review.
The install guidance is directly visible in the cited lines and uses remote skill identifiers without versions. This creates a clear supply-chain concern, even though it is user-facing documentation.
Low
External Image Service Data Disclosure
The examples send prompts and image URLs to external model apps through belt, but the skill does not place a privacy warning next to those workflows. This can expose sensitive prompts or images if users provide them.
The examples clearly invoke external image model apps with prompts and image URLs. The finding is limited to disclosure because the external service use is the stated purpose of the skill.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 9, 2026, 11:36 AM
The static Ruby backtick and hardcoded URL findings are mostly Markdown false positives, and I found no hidden executable code in SKILL.md. The remaining concerns are contextual: broad belt CLI permission, unpinned remote skill installation guidance, and user content being sent to external image services.
1
Files scanned
172
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (3)
Medium
Broad Belt CLI Permission Surface
The frontmatter permits Bash(belt *), so the assistant may invoke any belt subcommand. This is broader than the documented image workflow and can allow unintended account, file, or network operations through the CLI.
The broad tool permission is explicit in the skill frontmatter. The exact impact depends on the installed belt CLI subcommands, so the confidence is high but not critical.
Medium
Unpinned Remote Skill Installation Guidance
The skill recommends npx skills add for belt-sh/cli and several inference-sh/skills entries without pinning reviewed versions. Users who follow it may install remote skill content that changes after review.
The install guidance is directly visible in the cited lines and uses remote skill identifiers without versions. This creates a clear supply-chain concern, even though it is user-facing documentation.
Low
External Image Service Data Disclosure
The examples send prompts and image URLs to external model apps through belt, but the skill does not place a privacy warning next to those workflows. This can expose sensitive prompts or images if users provide them.
The examples clearly invoke external image model apps with prompts and image URLs. The finding is limited to disclosure because the external service use is the stated purpose of the skill.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jul 7, 2026, 05:53 AM
The skill is legitimate image-generation guidance, but it intentionally executes belt and npx CLI commands. Those commands call remote inference services and may send prompts, image URLs, and generated assets outside the local environment. I found no prompt-injection text or hidden data-exfiltration instructions.
1
Files scanned
172
Lines analyzed
22
Review items
0
False positives ignored
Capability review items (20)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install another CLI skill, which can execute third-party installer code. The behavior is visible and intentional, but it is real supply-chain command execution.
Medium
SKILL.md:19-24SKILL.md:50-52SKILL.md:58-63SKILL.md:67-72SKILL.md:76-80SKILL.md:84-86SKILL.md:90-94SKILL.md:98-103SKILL.md:107-111SKILL.md:115-119SKILL.md:123-125SKILL.md:129-134SKILL.md:138-162
Ruby/shell backtick execution · 13 occurrences
```bash
The quick start runs belt login and belt app run, which execute an external CLI and send prompt data to inference.sh. This is expected for the skill, but it is a real command-execution and network boundary.
Low
Hardcoded URL
Generate images with 50+ AI models via [inference.sh](https://inference.sh) CLI.
The link documents that the skill depends on inference.sh, a remote service used by the belt CLI. This is expected but confirms outbound network reliance.
Low
Hardcoded URL
. [Install instructions](https://raw.githubusercontent.com/infer
The install link points to raw.githubusercontent.com for setup instructions, introducing an external supply-chain dependency for users following the skill.
Low
Hardcoded URL
"images": ["https://your-image.jpg"]
The example asks users to submit an image URL for editing, which sends external image references to a remote model provider.
Low
Hardcoded URL
belt app run falai/topaz-image-upscaler --input '{"image_url": "https://..."}'
The upscaling example uses an image URL parameter, which sends a user image reference to a remote provider for processing.
Low
Hardcoded URL
"images": ["https://img1.jpg", "https://img2.jpg"],
The stitching example uses multiple image URLs, which sends user-provided image references to a remote provider for processing.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (9)
Audited by: codex
Jun 30, 2026, 08:15 PM
Static analysis flagged many external command and URL patterns plus one weak-cryptography pattern. Review found the command findings are mostly Markdown examples for the expected belt CLI workflow, and the weak-cryptography finding at SKILL.md line 3 appears to be a false positive with no cryptographic code present. The skill still carries medium risk because it instructs agents to run a networked CLI that sends prompts and image URLs to third-party inference services.
1
Files scanned
172
Lines analyzed
4
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Networked CLI Sends Prompts and Image URLs to External Services
The skill is designed around belt app run commands that call hosted inference.sh apps. This is legitimate for image generation, but user prompts and image URLs may be transmitted to third-party model providers, so users should avoid secrets, private images, and confidential brand assets unless policy permits it.
The documented commands invoke remote inference apps and include examples that pass prompts and image URLs. No malicious exfiltration intent was found, but external data transfer is central to the workflow.
Medium
Supply Chain Exposure From Skill Installation Commands
The documentation recommends installing CLI and related skills with npx skills add commands. This can be normal setup, but it introduces trust risk because users may fetch executable tooling or additional community skills from external repositories.
The installation commands are explicit and external. They appear related to the skill purpose, but users should review source and package provenance before running them.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Backtick Execution Findings Are Markdown False Positives
The analyzer reported many Ruby or shell backtick execution findings, but the reviewed locations are Markdown inline code, command examples, or code fences. They are not executable code inside the skill file, although the commands may be run by an agent when the user requests image generation.
The file is Markdown documentation, and the flagged backticks are formatting delimiters or examples. There is no Ruby source or automatic command execution in the reviewed content.
Low
Weak Cryptography Finding Is Not Supported by File Context
The analyzer flagged SKILL.md line 3 for weak cryptography, but that line is frontmatter describing image models and trigger phrases. No evidence of cryptographic code, hashing, encryption, or credential handling was found at that location.
Line 3 contains descriptive metadata only. The weak cryptography classification does not match the observed content.
Low
Hardcoded URLs Are Documentation and Example Inputs
The URLs point to inference.sh documentation, an image asset, install instructions, and placeholder image inputs. They do not show covert endpoints or automatic credential exfiltration, but they confirm that the skill depends on external network services.
The URLs are visible documentation links or sample image fields. No hidden data collection or suspicious destination was found in the reviewed file.
Risk Factors
⚙️ External commands (16)
🌐 Network access (9)
Detected Patterns
Allowed Bash Access for belt CommandsRemote Image Generation Commands
Audited by: codex
Jun 30, 2026, 08:15 PM
Static analysis flagged many external command and URL patterns plus one weak-cryptography pattern. Review found the command findings are mostly Markdown examples for the expected belt CLI workflow, and the weak-cryptography finding at SKILL.md line 3 appears to be a false positive with no cryptographic code present. The skill still carries medium risk because it instructs agents to run a networked CLI that sends prompts and image URLs to third-party inference services.
1
Files scanned
172
Lines analyzed
4
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Networked CLI Sends Prompts and Image URLs to External Services
The skill is designed around belt app run commands that call hosted inference.sh apps. This is legitimate for image generation, but user prompts and image URLs may be transmitted to third-party model providers, so users should avoid secrets, private images, and confidential brand assets unless policy permits it.
The documented commands invoke remote inference apps and include examples that pass prompts and image URLs. No malicious exfiltration intent was found, but external data transfer is central to the workflow.
Medium
Supply Chain Exposure From Skill Installation Commands
The documentation recommends installing CLI and related skills with npx skills add commands. This can be normal setup, but it introduces trust risk because users may fetch executable tooling or additional community skills from external repositories.
The installation commands are explicit and external. They appear related to the skill purpose, but users should review source and package provenance before running them.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Backtick Execution Findings Are Markdown False Positives
The analyzer reported many Ruby or shell backtick execution findings, but the reviewed locations are Markdown inline code, command examples, or code fences. They are not executable code inside the skill file, although the commands may be run by an agent when the user requests image generation.
The file is Markdown documentation, and the flagged backticks are formatting delimiters or examples. There is no Ruby source or automatic command execution in the reviewed content.
Low
Weak Cryptography Finding Is Not Supported by File Context
The analyzer flagged SKILL.md line 3 for weak cryptography, but that line is frontmatter describing image models and trigger phrases. No evidence of cryptographic code, hashing, encryption, or credential handling was found at that location.
Line 3 contains descriptive metadata only. The weak cryptography classification does not match the observed content.
Low
Hardcoded URLs Are Documentation and Example Inputs
The URLs point to inference.sh documentation, an image asset, install instructions, and placeholder image inputs. They do not show covert endpoints or automatic credential exfiltration, but they confirm that the skill depends on external network services.
The URLs are visible documentation links or sample image fields. No hidden data collection or suspicious destination was found in the reviewed file.
Risk Factors
⚙️ External commands (16)
🌐 Network access (9)
Detected Patterns
Allowed Bash Access for belt CommandsRemote Image Generation Commands
Audited by: codex
May 21, 2026, 09:19 AM
All 55 static analysis findings are false positives. The skill is a Markdown documentation file that shows CLI usage examples for the inference.sh belt tool. Backtick patterns flagged as shell execution are actually Markdown code blocks within fenced code blocks. The flagged URLs are legitimate documentation and placeholder example links. No malicious intent or dangerous code patterns were found.
1
Files scanned
172
Lines analyzed
4
Review items
1
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Low
Markdown code blocks flagged as shell backtick execution
Static analyzer flagged 44 Markdown fenced code blocks as Ruby/shell backtick execution. All instances are within ```bash code fences showing CLI usage examples. No actual command execution occurs in the Markdown file. The skill does require Bash access via the allowed-tools directive, but the flagged patterns are documentation, not exploits.
All flagged lines are standard Markdown fenced code blocks. The static analyzer incorrectly interpreted backtick code fences as Ruby shell backtick execution.
Low
Documentation URLs flagged as hardcoded network endpoints
Static analyzer flagged 10 URLs as hardcoded network references. All URLs point to legitimate documentation (inference.sh), GitHub installation instructions, or are placeholder examples (https://your-image.jpg, https://img1.jpg). No data exfiltration or malicious endpoints.
All URLs resolve to the legitimate inference.sh domain or are clearly placeholder examples. No suspicious domains or encoded payloads detected.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak cryptographic algorithm detection is false positive
Static analyzer flagged line 3 for a weak cryptographic algorithm. Line 3 is the YAML front matter description listing model names including Seedream and Gemini. No cryptographic algorithms or operations are present anywhere in the file.
The description field contains model names, not cryptographic algorithms. No crypto-related code exists in the file.
Risk Factors
⚙️ External commands (44)
SKILL.md:7 SKILL.md:17 SKILL.md:19-24 SKILL.md:24-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-37 SKILL.md:37-38 SKILL.md:38-39 SKILL.md:39-40 SKILL.md:40-41 SKILL.md:41-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-50 SKILL.md:50-52 SKILL.md:52-58 SKILL.md:58-63 SKILL.md:63-67 SKILL.md:67-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80-84 SKILL.md:84-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-103 SKILL.md:103-107 SKILL.md:107-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-125 SKILL.md:125-129 SKILL.md:129-134 SKILL.md:134-138 SKILL.md:138-162 SKILL.md:162-164
🌐 Network access (10)
Audited by: claude