{"data":{"skill":{"slug":"agentspace-so-seedance-v2","name":"seedance-v2","icon":"📦","repo":"https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/seedance-v2/","status":"approved","author":"agentspace-so","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"10705950-26c9-4921-a533-ca6bd55006fd","skill_id":"886310c3-3b7e-425d-8f1c-170949d8017d","version":1,"content_hash":"94bede9c7492084acafa6ffbb83c1ef1","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All static findings are false positives. The skill is a video generation documentation file with CLI command examples in markdown code blocks. The external_commands alerts flag markdown code fences (```bash) rather than actual shell execution. Hardcoded URLs are legitimate documentation links. Path traversal patterns are placeholder paths in examples. Token storage uses standard secure CLI practices with mode 0600 permissions. No malicious patterns confirmed.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":74,"line_start":70},{"file":"SKILL.md","line_end":87,"line_start":78},{"file":"SKILL.md","line_end":100,"line_start":91}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":173,"line_start":173}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":177,"line_start":177}]}],"critical_findings":[],"high_findings":[{"title":"False Positive: Ruby/shell backtick pattern in markdown code blocks","locations":[{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":74,"line_start":70}],"confidence":0.95,"description":"The static scanner flags backtick patterns in markdown code fences as 'Ruby/shell backtick execution'. These are documentation code examples showing CLI commands like `runcomfy run bytedance/seedance-v2/pro`. No shell execution occurs - these are markdown syntax for inline code and fenced code blocks. Verified at lines 24-26, 70-74, 78-87, 91-100, and throughout the document.","confidence_reasoning":"Code fences (```bash) and inline backticks in markdown are documentation syntax, not shell backtick execution. The content describes CLI usage examples with hardcoded commands, not dynamic code generation."},{"title":"False Positive: Path traversal in documentation placeholders","locations":[{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":97,"line_start":97}],"confidence":0.95,"description":"The static scanner flags `<absolute/path>` as path traversal. These are documentation placeholders showing users where to specify their output directory. They are not actual path traversal exploits - the skill documentation is teaching users how to use CLI arguments properly.","confidence_reasoning":"The placeholder <absolute/path> is standard documentation syntax teaching users CLI argument usage. No user input is processed into file paths without validation."},{"title":"False Positive: Weak cryptographic algorithm on 'seed' keyword","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":106,"line_start":106}],"confidence":0.9,"description":"The static scanner flags 'seed' as a weak cryptographic algorithm indicator. In this context, 'seed' refers to a video generation reproducibility parameter (line 64 in the schema table), not cryptography. This is a completely different semantic context.","confidence_reasoning":"The word 'seed' appears in a video generation context (schema field for reproducibility), not cryptographic usage. No actual cryptographic operations are performed in this documentation file."}],"medium_findings":[{"title":"Hardcoded URLs are legitimate documentation links","locations":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":169,"line_start":169}],"confidence":0.95,"description":"Static scanner flagged hardcoded URLs at lines 14, 20, 169, and 173. These are legitimate documentation links to runcomfy.com, docs.runcomfy.com, and model-api.runcomfy.net. No malicious URLs detected.","confidence_reasoning":"All flagged URLs point to runcomfy.com and associated domains - the legitimate service provider for this skill. No suspicious external endpoints detected."},{"title":"Token file storage at ~/.config/runcomfy/token.json","locations":[{"file":"SKILL.md","line_end":177,"line_start":177}],"confidence":0.85,"description":"The skill documents storing API tokens in ~/.config/runcomfy/token.json. This is a standard CLI tool pattern and the documentation explicitly mentions using mode 0600 (owner-only) permissions. For CI environments, the skill recommends using RUNCOMFY_TOKEN environment variable instead.","confidence_reasoning":"Standard secure CLI practice with documented permission requirements. Token storage is explicitly documented with security controls."}],"low_findings":[{"title":"False Positive: System reconnaissance patterns","locations":[{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":112,"line_start":112}],"confidence":0.9,"description":"The static scanner flagged lines 42 and 112 as 'system reconnaissance'. Line 42 is a routing condition ('If the user said Seedance...') and line 112 documents reference media specs. These are not reconnaissance patterns - they are legitimate skill routing logic and documentation.","confidence_reasoning":"No system information gathering detected. Line 42 is prompt routing logic, line 112 is documentation about reference media specifications."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":182,"audit_model":"claude","audited_at":"2026-05-05T08:55:24.15+00:00","created_at":"2026-05-05T13:38:58.769605+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":5,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}