{"data":{"skill":{"slug":"agentspace-so-image-to-video","name":"image-to-video","icon":"📦","repo":"https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/image-to-video/","status":"approved","author":"agentspace-so","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"6272c97a-1d83-4f77-87a0-ca77b5cbf7ee","skill_id":"55c9e98f-1651-4b1d-8e24-c4a02c08358e","version":1,"content_hash":"6e8078e1ad8ef49ef6ccb63bb1a2047c","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All static findings are false positives. The 91 backtick detections are Markdown inline code formatting in documentation, not shell execution. Network URLs are legitimate RunComfy service endpoints. Path traversal warnings are documentation placeholders. Credential storage uses proper file permissions (0600). CLI does not shell-expand prompts, preventing injection. No malicious patterns detected.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":28,"line_start":28}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":23,"line_start":17}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":201,"line_start":201}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"External Command References (False Positive)","locations":[{"file":"SKILL.md","line_end":9,"line_start":9}],"confidence":0.95,"description":"91 backtick detections are Markdown code formatting (e.g., `runcomfy run`), not shell execution. This is a documentation file with embedded CLI examples in code blocks. No actual command injection surface exists.","confidence_reasoning":"Backticks in Markdown files are standard inline code syntax. The skill document uses `runcomfy run` as a reference to CLI command names, not as executable code."},{"title":"Hardcoded URLs (Expected Behavior)","locations":[{"file":"SKILL.md","line_end":17,"line_start":17}],"confidence":0.9,"description":"12 URL detections point to legitimate RunComfy service endpoints: model-api.runcomfy.net, happyhorse models, wan-ai, bytedance/seedance. These are documented external services that the skill routes to.","confidence_reasoning":"URLs are RunComfy-owned domains documented in the skill. The skill explicitly whitelists these endpoints in the Security section."},{"title":"Path Traversal Placeholders (Not Exploitable)","locations":[{"file":"SKILL.md","line_end":77,"line_start":77}],"confidence":0.85,"description":"The <absolute/path> placeholder in --output-dir examples is a documentation template. Users substitute their own paths. No directory traversal vulnerability exists.","confidence_reasoning":"Placeholder text <absolute/path> is standard documentation convention. The CLI accepts user-provided paths, which is expected behavior."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":206,"audit_model":"claude","audited_at":"2026-05-05T08:55:32.193+00:00","created_at":"2026-05-05T13:38:58.827293+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"low","confirmedFindingCount":1,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}