{"data":{"skill":{"slug":"agentspace-so-seedance-v2","name":"seedance-v2","icon":"📦","repo":"https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/seedance-v2/","status":"approved","author":"agentspace-so","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"b6ab45c2-ccd8-44ec-9e6f-94e846e3a6a3","skill_id":"886310c3-3b7e-425d-8f1c-170949d8017d","version":2,"content_hash":"9ffdc5bafb543159f823f3fb5e1594b8","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"The static analyzer reported many command, network, filesystem, and blocker patterns, but most high-severity blocker hits are Markdown false positives. The confirmed risks are legitimate for this skill: it instructs agents to run the RunComfy CLI, submit prompts and media references to an external model API, download generated files, and rely on local token storage. No evidence found of malicious intent or prompt injection text in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":48,"line_start":46},{"file":"SKILL.md","line_end":73,"line_start":70},{"file":"SKILL.md","line_end":86,"line_start":78},{"file":"SKILL.md","line_end":99,"line_start":91},{"file":"SKILL.md","line_end":173,"line_start":173}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":97,"line_start":95},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":173,"line_start":173},{"file":"SKILL.md","line_end":180,"line_start":180}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":99,"line_start":99},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":177,"line_start":177}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"External CLI Execution Required","locations":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":48,"line_start":46},{"file":"SKILL.md","line_end":73,"line_start":70},{"file":"SKILL.md","line_end":173,"line_start":173}],"confidence":0.86,"description":"TRUE_POSITIVE: The skill intentionally directs the agent to install, log in to, and run the RunComfy CLI. This is a real execution risk because commands run locally and process user-provided prompt input, even though the documented command uses JSON input and no direct shell expansion was found.","confidence_reasoning":"The command behavior is explicitly documented in SKILL.md and is central to the skill. Confidence is below very high because the file states prompt content is passed as JSON, which lowers command injection likelihood."},{"title":"External Network Submission and Downloads","locations":[{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":97,"line_start":95},{"file":"SKILL.md","line_end":173,"line_start":173},{"file":"SKILL.md","line_end":180,"line_start":180}],"confidence":0.84,"description":"TRUE_POSITIVE: The skill sends prompts and media references to the RunComfy Model API and downloads generated output URLs. This can expose prompt text, supplied media URLs, and generated files to a third-party service, which requires user awareness and trust in the provider.","confidence_reasoning":"Network use is clearly described with an API endpoint and output download domains. The domains appear related to the declared service, so this is a privacy and supply-chain risk rather than evidence of exfiltration."},{"title":"Local Token and Generated File Handling","locations":[{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":177,"line_start":177}],"confidence":0.78,"description":"TRUE_POSITIVE: The skill documents local token storage and generated file downloads into a selected output directory. This is a filesystem risk because credentials and large generated files are handled locally, although the file claims token permissions are owner-only and downloads have a size cap.","confidence_reasoning":"The filesystem behavior is directly documented. The security impact is moderate because the described paths and token handling are expected for a CLI integration, not hidden behavior."}],"low_findings":[{"title":"Path Traversal Static Hits Are Placeholder URLs","locations":[{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":97,"line_start":95}],"confidence":0.93,"description":"FALSE_POSITIVE: The path traversal findings map to placeholder media URLs using ellipses in examples, not filesystem traversal code. No evidence found that the skill constructs paths from untrusted input or uses ../ sequences to access local files.","confidence_reasoning":"The flagged text is inside Markdown examples for remote image, video, and audio references. The surrounding context describes API media inputs, not local path access."},{"title":"Weak Cryptography Static Hits Are Text False Positives","locations":[{"file":"SKILL.md","line_end":10,"line_start":4},{"file":"SKILL.md","line_end":117,"line_start":106},{"file":"SKILL.md","line_end":169,"line_start":158}],"confidence":0.91,"description":"FALSE_POSITIVE: The weak cryptography findings align with ordinary prose, headings, or model guidance. No evidence found of cryptographic code, hashing functions, cipher selection, or security-sensitive algorithm use in SKILL.md.","confidence_reasoning":"The skill is Markdown documentation and contains no implementation code for encryption or hashing. The static pattern appears to match incidental words rather than executable crypto logic."},{"title":"Reconnaissance Static Hits Are Routing and Specification Text","locations":[{"file":"SKILL.md","line_end":42,"line_start":42},{"file":"SKILL.md","line_end":112,"line_start":112}],"confidence":0.88,"description":"FALSE_POSITIVE: The system reconnaissance findings occur in prose about model routing and media requirements. No evidence found of commands that inspect the host, enumerate files, collect environment data, or fingerprint the system.","confidence_reasoning":"The relevant lines are plain user guidance, not executable host inspection. The broader file does not contain reconnaissance commands."}],"dangerous_patterns":[{"title":"Shell Command Examples for RunComfy","locations":[{"file":"SKILL.md","line_end":26,"line_start":24},{"file":"SKILL.md","line_end":48,"line_start":46},{"file":"SKILL.md","line_end":73,"line_start":70}],"confidence":0.82,"description":"The skill contains shell command examples for npx, npm, runcomfy login, and runcomfy run. These commands are expected for this integration but require user approval and careful argument handling.","confidence_reasoning":"The commands are visible in Markdown blocks and prerequisites. They are not hidden, but they would execute locally if followed."},{"title":"Third-Party API Endpoint","locations":[{"file":"SKILL.md","line_end":173,"line_start":173},{"file":"SKILL.md","line_end":180,"line_start":180}],"confidence":0.85,"description":"The skill documents POST requests to RunComfy model infrastructure and output downloads from RunComfy domains. This is expected behavior but should be disclosed as third-party processing.","confidence_reasoning":"The endpoint and domains are explicit. They match the skill purpose, so the risk is transparency and data handling rather than confirmed abuse."},{"title":"Credential Storage Path Mentioned","locations":[{"file":"SKILL.md","line_end":177,"line_start":177}],"confidence":0.76,"description":"The skill states that RunComfy login writes an API token under the user config directory. Credential files must be protected and should not be shared through prompts, logs, or generated artifacts.","confidence_reasoning":"The token path is directly stated. The line also claims restrictive permissions, which reduces but does not remove credential-handling risk."}],"files_scanned":1,"total_lines":182,"audit_model":"codex","audited_at":"2026-06-28T05:19:54.433+00:00","created_at":"2026-06-28T06:42:28.158006+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}