image-to-video
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the vendor's command-line interface (CLI) using
npx skills add belt-sh/cli. It also references an installation script hosted on the vendor's official GitHub repository (raw.githubusercontent.com/inference-sh/skills/main/cli-install.md). These are legitimate resources from the skill's authoring organization. - [COMMAND_EXECUTION]: The skill includes several code blocks demonstrating how to use the
beltCLI tool. These commands are for generating images, animating them via specific AI models (e.g.,falai/wan-2-5-i2v), and post-processing tasks like upscaling or merging audio. These examples align with the skill's primary purpose of image-to-video conversion and use the vendor's own tools. - [METADATA_POISONING]: The YAML frontmatter includes an
allowed-toolsfield that scopes the skill to use the vendor-specificBash(belt *)tool. This is a standard platform configuration that limits the skill's execution environment to the intended tools.
Audit Metadata