Versioned security assessment

Report ID: SA-07F4BB57

6/30/2026, 8:15:51 PM

ai-image-generation security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ai-image-generation
Version
v3
Maintainer
skills-shell
Source
github.com/skills-shell/skills/tree/main/tools/image/ai-image-generation/
Coverage
1 Files scanned · 172 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis flagged many external command and URL patterns plus one weak-cryptography pattern. Review found the command findings are mostly Markdown examples for the expected belt CLI workflow, and the weak-cryptography finding at SKILL.md line 3 appears to be a false positive with no cryptographic code present. The skill still carries medium risk because it instructs agents to run a networked CLI that sends prompts and image URLs to third-party inference services.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 172 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 16 evidence locations

Capability review items (2)
Medium
SKILL.md:17SKILL.md:58-63SKILL.md:67-72SKILL.md:123-131
Networked CLI Sends Prompts and Image URLs to External Services
The skill is designed around belt app run commands that call hosted inference.sh apps. This is legitimate for image generation, but user prompts and image URLs may be transmitted to third-party model providers, so users should avoid secrets, private images, and confidential brand assets unless policy permits it.
The documented commands invoke remote inference apps and include examples that pass prompts and image URLs. No malicious exfiltration intent was found, but external data transfer is central to the workflow.
Medium
SKILL.md:7SKILL.md:138-162
Supply Chain Exposure From Skill Installation Commands
The documentation recommends installing CLI and related skills with npx skills add commands. This can be normal setup, but it introduces trust risk because users may fetch executable tooling or additional community skills from external repositories.
The installation commands are explicit and external. They appear related to the skill purpose, but users should review source and package provenance before running them.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:19-24SKILL.md:31-46SKILL.md:50-52SKILL.md:138-162
Static Backtick Execution Findings Are Markdown False Positives
The analyzer reported many Ruby or shell backtick execution findings, but the reviewed locations are Markdown inline code, command examples, or code fences. They are not executable code inside the skill file, although the commands may be run by an agent when the user requests image generation.
The file is Markdown documentation, and the flagged backticks are formatting delimiters or examples. There is no Ruby source or automatic command execution in the reviewed content.
Low
SKILL.md:3
Weak Cryptography Finding Is Not Supported by File Context
The analyzer flagged SKILL.md line 3 for weak cryptography, but that line is frontmatter describing image models and trigger phrases. No evidence of cryptographic code, hashing, encryption, or credential handling was found at that location.
Line 3 contains descriptive metadata only. The weak cryptography classification does not match the observed content.
Low
SKILL.md:11-17SKILL.md:70SKILL.md:124-131SKILL.md:168-170
Hardcoded URLs Are Documentation and Example Inputs
The URLs point to inference.sh documentation, an image asset, install instructions, and placeholder image inputs. They do not show covert endpoints or automatic credential exfiltration, but they confirm that the skill depends on external network services.
The URLs are visible documentation links or sample image fields. No hidden data collection or suspicious destination was found in the reviewed file.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable