ai-content-pipeline
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing external packages and skills from the inference-sh and belt-sh organizations on GitHub and npm (e.g., npx skills add belt-sh/cli and npx skills add inference-sh/skills@...). While these are essential for the skill's functionality, they originate from external sources that are not part of the standard pre-approved lists.
- [COMMAND_EXECUTION]: The skill uses the Bash tool restricted to the belt CLI (Bash(belt *)) to perform operations such as logging in and running AI applications (belt app run). This allows the agent to interact directly with a remote inference service and manage local output files.
- [PROMPT_INJECTION]: The skill documents and encourages the creation of multi-step pipelines where the output from one AI model is used as the direct input for another without intermediate validation or sanitization, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the pipeline via the '--input' prompt parameters in various scripts and is passed between steps (e.g., using outputs from image.json or script.json in subsequent commands).
- Boundary markers: The provided examples do not use delimiters or explicit 'ignore' instructions to separate model-generated content from pipeline control logic.
- Capability inventory: The skill utilizes shell execution (via belt CLI) to perform remote model inference, file writing, and media merging operations.
- Sanitization: There is no evidence of content sanitization or validation of the data being passed between the various pipeline stages.
Audit Metadata