Versioned security assessment

Report ID: SA-1DE57F2D

7/7/2026, 5:53:15 AM

ai-image-generation security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ai-image-generation
Version
v4
Maintainer
skills-shell
Source
github.com/skills-shell/skills/tree/main/tools/image/ai-image-generation/
Coverage
1 Files scanned · 172 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is legitimate image-generation guidance, but it intentionally executes belt and npx CLI commands. Those commands call remote inference services and may send prompts, image URLs, and generated assets outside the local environment. I found no prompt-injection text or hidden data-exfiltration instructions.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 172 Lines analyzed

20 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 44 evidence locations

Capability review items (20)
Medium
SKILL.md:7
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install another CLI skill, which can execute third-party installer code. The behavior is visible and intentional, but it is real supply-chain command execution.
Medium
SKILL.md:19-24
Ruby/shell backtick execution
```bash
The quick start runs belt login and belt app run, which execute an external CLI and send prompt data to inference.sh. This is expected for the skill, but it is a real command-execution and network boundary.
Medium
SKILL.md:50-52
Ruby/shell backtick execution
```bash
The fenced example runs belt app store, which invokes the external CLI to query remote image apps. It is intended functionality, but still depends on command execution.
Medium
SKILL.md:58-63
Ruby/shell backtick execution
```bash
The example runs belt app run openai/gpt-image-2 with a prompt, sending generation data to a remote service through the CLI.
Medium
SKILL.md:67-72
Ruby/shell backtick execution
```bash
The editing example runs belt app run and submits an image URL to a remote model provider. This is intended but exposes user-provided image references outside the local environment.
Medium
SKILL.md:76-80
Ruby/shell backtick execution
```bash
The FLUX example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:84-86
Ruby/shell backtick execution
```bash
The fast generation example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:90-94
Ruby/shell backtick execution
```bash
The Gemini example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:98-103
Ruby/shell backtick execution
```bash
The Grok example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:107-111
Ruby/shell backtick execution
```bash
The Reve example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:115-119
Ruby/shell backtick execution
```bash
The Seedream example runs belt app run with prompt content, sending generation data to a remote service through the CLI.
Medium
SKILL.md:123-125
Ruby/shell backtick execution
```bash
The upscaling example runs belt app run with an external image URL, causing remote processing of a user image reference.
Medium
SKILL.md:129-134
Ruby/shell backtick execution
```bash
The stitching example runs belt app run with external image URLs, causing remote processing of user-provided image references.
Medium
SKILL.md:138-162
Ruby/shell backtick execution
```bash
The related skills block instructs npx skills add commands from a community source, creating supply-chain installation risk if run blindly.
Low
SKILL.md:11
Hardcoded URL
Generate images with 50+ AI models via [inference.sh](https://inference.sh) CLI.
The link documents that the skill depends on inference.sh, a remote service used by the belt CLI. This is expected but confirms outbound network reliance.
Low
SKILL.md:13
Hardcoded URL
![AI Image Generation](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kg0v0nz7w
The Markdown image embeds content from cloud.inference.sh, which can trigger remote loading when rendered and can change outside the package.
Low
SKILL.md:17
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The install link points to raw.githubusercontent.com for setup instructions, introducing an external supply-chain dependency for users following the skill.
Low
SKILL.md:70
Hardcoded URL
"images": ["https://your-image.jpg"]
The example asks users to submit an image URL for editing, which sends external image references to a remote model provider.
Low
SKILL.md:124
Hardcoded URL
belt app run falai/topaz-image-upscaler --input '{"image_url": "https://..."}'
The upscaling example uses an image URL parameter, which sends a user image reference to a remote provider for processing.
Low
SKILL.md:131
Hardcoded URL
"images": ["https://img1.jpg", "https://img2.jpg"],
The stitching example uses multiple image URLs, which sends user-provided image references to a remote provider for processing.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Unpinned CLI and skill installs
    Pin trusted install sources or versions for belt-related skill installation examples.
  2. FIX-002
    Medium
    Remote inference data exposure
    Add a privacy note explaining that prompts, image URLs, and outputs are sent to inference.sh and model providers.
  3. FIX-003
    Low
    Placeholder external image URLs
    Tell users to avoid private images unless they accept the provider data handling terms.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable