Versioned security assessment

Report ID: SA-0519034D

7/9/2026, 11:36:55 AM

ai-image-generation security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
ai-image-generation
Version
v6
Maintainer
skills-shell
Source
github.com/skills-shell/skills/tree/main/tools/image/ai-image-generation/
Coverage
1 Files scanned · 172 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static Ruby backtick and hardcoded URL findings are mostly Markdown false positives, and I found no hidden executable code in SKILL.md. The remaining concerns are contextual: broad belt CLI permission, unpinned remote skill installation guidance, and user content being sent to external image services.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 172 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 44 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:4
Broad Belt CLI Permission Surface
The frontmatter permits Bash(belt *), so the assistant may invoke any belt subcommand. This is broader than the documented image workflow and can allow unintended account, file, or network operations through the CLI.
The broad tool permission is explicit in the skill frontmatter. The exact impact depends on the installed belt CLI subcommands, so the confidence is high but not critical.
RISK-002 Medium
SKILL.md:7SKILL.md:138-162
Unpinned Remote Skill Installation Guidance
The skill recommends npx skills add for belt-sh/cli and several inference-sh/skills entries without pinning reviewed versions. Users who follow it may install remote skill content that changes after review.
The install guidance is directly visible in the cited lines and uses remote skill identifiers without versions. This creates a clear supply-chain concern, even though it is user-facing documentation.
RISK-003 Low
SKILL.md:58-124
External Image Service Data Disclosure
The examples send prompts and image URLs to external model apps through belt, but the skill does not place a privacy warning next to those workflows. This can expose sensitive prompts or images if users provide them.
The examples clearly invoke external image model apps with prompts and image URLs. The finding is limited to disclosure because the external service use is the stated purpose of the skill.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Broad belt CLI permission
    Restrict allowed tools to the specific belt commands required for image generation, or require confirmation before each belt command.
  2. FIX-002
    Medium
    Unpinned remote installations
    Pin skill and CLI installation instructions to reviewed refs, checksums, or package versions.
  3. FIX-003
    Low
    External service data disclosure
    Warn users before sending prompts or image URLs to inference.sh or provider apps, and advise against sensitive content.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
0519034dad657fb1f7706e0550e962beeda73fdf
Content hash
58ff981bd98201e835d04bb5dd1c401f4368d56fa686cdefeb04f612f7a27ea3
Tree hash
22bb2e39a3366aea410fa1c220ec145bb8c4d5362bf208112f6a8b6bf1b243d6
Skill path
skills/skills-shell/ai-image-generation
Audit payload hash
26544e68ffe9c8bb7fa467747b3879c4

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable