{"data":{"skill":{"slug":"agentspace-so-happyhorse-1-0","name":"happyhorse-1-0","icon":"📦","repo":"https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/happyhorse-1-0/","status":"approved","author":"agentspace-so","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8da845b7-c2a8-4c33-b5e1-51b43e0ed59f","skill_id":"6dc783c3-c1bb-406b-87c3-27e6ed80b487","version":7,"content_hash":"c3d4bf8877be6fad051fb80050947422","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The skill primarily documents a legitimate RunComfy text-to-video workflow, including expected CLI commands and outbound RunComfy API access. Most static hits are Markdown backticks, code fences, URL documentation, or ellipses in API paths rather than malicious behavior. The remaining confirmed issues are the intended external CLI and third-party network dependency, so users should install and run it only when they trust RunComfy and understand credential handling.","remediation":[{"issue":"External CLI execution is central to the skill.","severity":"medium","suggestion":"Tell users to review the RunComfy CLI package before installation and run commands only in trusted environments."},{"issue":"Prompts and job metadata are sent to a third-party API.","severity":"low","suggestion":"Warn users not to include secrets, private customer data, or unreleased content in prompts unless their RunComfy account and policies permit it."},{"issue":"Credential storage depends on the local RunComfy CLI.","severity":"low","suggestion":"Recommend RUNCOMFY_TOKEN for CI and confirm local token files use owner-only permissions."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":44,"line_start":26},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":54,"line_start":50},{"file":"SKILL.md","line_end":55,"line_start":54},{"file":"SKILL.md","line_end":55,"line_start":55},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":58},{"file":"SKILL.md","line_end":65,"line_start":59},{"file":"SKILL.md","line_end":69,"line_start":65},{"file":"SKILL.md","line_end":73,"line_start":69},{"file":"SKILL.md","line_end":82,"line_start":73},{"file":"SKILL.md","line_end":86,"line_start":82},{"file":"SKILL.md","line_end":90,"line_start":86},{"file":"SKILL.md","line_end":92,"line_start":90},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":98,"line_start":98},{"file":"SKILL.md","line_end":104,"line_start":102},{"file":"SKILL.md","line_end":104,"line_start":104},{"file":"SKILL.md","line_end":133,"line_start":126},{"file":"SKILL.md","line_end":137,"line_start":133},{"file":"SKILL.md","line_end":143,"line_start":137},{"file":"SKILL.md","line_end":147,"line_start":143},{"file":"SKILL.md","line_end":152,"line_start":147},{"file":"SKILL.md","line_end":158,"line_start":152},{"file":"SKILL.md","line_end":163,"line_start":158},{"file":"SKILL.md","line_end":169,"line_start":163},{"file":"SKILL.md","line_end":178,"line_start":169},{"file":"SKILL.md","line_end":179,"line_start":178},{"file":"SKILL.md","line_end":180,"line_start":179},{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":181,"line_start":181},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":191,"line_start":191},{"file":"SKILL.md","line_end":194,"line_start":192},{"file":"SKILL.md","line_end":194,"line_start":194}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":174,"line_start":174},{"file":"SKILL.md","line_end":179,"line_start":179}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":181,"line_start":181},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":191,"line_start":191},{"file":"SKILL.md","line_end":191,"line_start":191}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":10,"line_start":10}],"confidence":0.78,"description":"Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":45,"line_start":44}],"confidence":0.78,"description":"1. **RunComfy CLI** — `npm i -g @runcomfy/cli`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":46,"line_start":45}],"confidence":0.78,"description":"2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":46,"line_start":46}],"confidence":0.78,"description":"3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":69,"line_start":65}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":82,"line_start":73}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":90,"line_start":86}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":92,"line_start":92}],"confidence":0.78,"description":"The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.co","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":179,"line_start":178}],"confidence":0.78,"description":"1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matchin","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":180,"line_start":179}],"confidence":0.78,"description":"2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":180,"line_start":180}],"confidence":0.78,"description":"3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 second","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":181,"line_start":181}],"confidence":0.78,"description":"4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose ho","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":182,"line_start":182}],"confidence":0.78,"description":"5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":191,"line_start":191}],"confidence":0.78,"description":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":194,"line_start":192}],"confidence":0.78,"description":"- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI d","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":194,"line_start":194}],"confidence":0.78,"description":"- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / ","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":179,"line_start":179}],"confidence":0.86,"description":"2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill documents a real outbound HTTPS request to the RunComfy Model API using the user bearer token. This is expected for the video generation workflow but remains third-party network access."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":196,"audit_model":"claude","audited_at":"2026-07-09T05:39:15.939+00:00","created_at":"2026-07-09T06:43:48.657655+00:00","static_findings":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":44,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **RunComfy CLI** — `npm i -g @runcomfy/cli`","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `happyhorse/happyhorse-1-0/text-to-video`","category":"external_commands","line_end":54,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Up to 2,500 chars. 6 languages (CN/EN/JP/KR/DE/FR). |","category":"external_commands","line_end":55,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `aspect_ratio` | enum | no | `16:9` | `16:9`, `9:16`, `1:1`, `4:3`, `3:4` only. |","category":"external_commands","line_end":55,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `1080P` | `720P` or `1080P`. |","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | int | no | 5 | 3–15 seconds. |","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | 0 | 0..2^31-1. Reuse for variant comparisons. |","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `watermark` | bool | no | true | Provider watermark. |","category":"external_commands","line_end":65,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":69,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":73,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":82,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":86,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":90,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.co","category":"external_commands","line_end":92,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Camera + shot in plain English.** Front-load the shot: `\"Wide shot. ...\"` / `\"Tracking shot. ...\"`","category":"external_commands","line_end":98,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Multi-shot consistency** — when describing two beats, restate the anchor at each: `\"Shot 1: tall w","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Audio direction** — say what you want to hear: `\"distant temple bells, footsteps on wet pavement, ","category":"external_commands","line_end":104,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":133,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":133},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":152,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":158,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Audio is in-pass only** — you can't pass external audio to drive lip-sync. For audio-driven lip-","category":"external_commands","line_end":163,"severity":"medium","line_start":158},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `runcomfy` CLI uses sysexits-style codes:","category":"external_commands","line_end":169,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 65 | bad input JSON / schema mismatch (e.g. `duration: 30` would 422) |","category":"external_commands","line_end":178,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matchin","category":"external_commands","line_end":179,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide","category":"external_commands","line_end":180,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 second","category":"external_commands","line_end":180,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose ho","category":"external_commands","line_end":181,"severity":"medium","line_start":181},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you ","category":"external_commands","line_end":182,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"external_commands","line_end":191,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI d","category":"external_commands","line_end":194,"severity":"medium","line_start":192},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / ","category":"external_commands","line_end":194,"severity":"medium","line_start":194},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://www.runcomfy.com","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=happyhor","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:174:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshootin","category":"network","line_end":174,"severity":"low","line_start":174},{"id":"network:SKILL.md:179:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide","category":"network","line_end":179,"severity":"low","line_start":179},{"id":"filesystem:SKILL.md:180:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 second","category":"filesystem","line_end":180,"severity":"high","line_start":180},{"id":"filesystem:SKILL.md:181:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose ho","category":"filesystem","line_end":181,"severity":"high","line_start":181},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you ","category":"filesystem","line_end":182,"severity":"high","line_start":182},{"id":"filesystem:SKILL.md:191:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":191,"severity":"high","line_start":191},{"id":"filesystem:SKILL.md:191:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":191,"severity":"medium","line_start":191},{"id":"blocker:SKILL.md:40:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"If the user said \"HappyHorse\" / \"happy horse video\" explicitly, route here regardless.","category":"blocker","line_end":40,"severity":"low","line_start":40}],"finding_verdicts":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:133:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting around field names, sample prompts, tables, or code fence delimiters. They do not introduce separate command execution beyond the documented RunComfy workflow.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:181:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:192:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"The skill intentionally instructs use of the RunComfy CLI or documents its credential and network behavior. This is legitimate for the feature, but it is still external command execution with third-party service access.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The URL is a documentation, homepage, model page, or troubleshooting link. It is not an instruction to exfiltrate data or contact an unrelated service.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The URL is a documentation, homepage, model page, or troubleshooting link. It is not an instruction to exfiltrate data or contact an unrelated service.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:174:hardcoded-url","reason":"The URL is a documentation, homepage, model page, or troubleshooting link. It is not an instruction to exfiltrate data or contact an unrelated service.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:179:hardcoded-url","reason":"The skill documents a real outbound HTTPS request to the RunComfy Model API using the user bearer token. This is expected for the video generation workflow but remains third-party network access.","verdict":"confirmed","severity":"low","confidence":0.86},{"id":"filesystem:SKILL.md:180:path-traversal-sequence","reason":"The line documents where the official CLI stores its token with owner-only permissions and offers an environment-token alternative. The skill itself does not read hidden files or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:181:path-traversal-sequence","reason":"The line documents where the official CLI stores its token with owner-only permissions and offers an environment-token alternative. The skill itself does not read hidden files or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","reason":"The line documents where the official CLI stores its token with owner-only permissions and offers an environment-token alternative. The skill itself does not read hidden files or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:191:hidden-file-in-home-directory","reason":"The line documents where the official CLI stores its token with owner-only permissions and offers an environment-token alternative. The skill itself does not read hidden files or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:SKILL.md:191:hidden-file-access","reason":"The line documents where the official CLI stores its token with owner-only permissions and offers an environment-token alternative. The skill itself does not read hidden files or request arbitrary filesystem access.","verdict":"false_positive","confidence":0.82},{"id":"blocker:SKILL.md:40:system-reconnaissance","reason":"The line is routing guidance for choosing the HappyHorse model when the user asks for it. It is not system reconnaissance or host inspection.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":17,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}