{"data":{"skill":{"slug":"gencraft-labs-image-to-video","name":"image-to-video","icon":"📦","repo":"https://github.com/gencraft-labs/skills/tree/5d625f59c710d7a33316b50b302b7158cdee5971/image-to-video","status":"approved","author":"gencraft-labs","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"20e1552c-b100-4aae-ad81-01f372d65602","skill_id":"9654ce83-8ac7-4b55-b895-2ea96166fd55","version":1,"content_hash":"v3:e406bf64b5db6e514879399e87b346fa7ff7c2fb:7a97ff688209d3cad39a9d84b284b209c3b3cdcc775fb91b4711b2eb1555ad7b:9c50b2b32907fb02cb6ae3b02f8a7328ca6eaf4054b376100afa5591b5492007:736b696c6c732f67656e63726166742d6c6162732f696d6167652d746f2d766964656f:c1f478e668d7badd6ccbd4bcddee561e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 67 static findings are false positives involving Markdown, placeholder URLs, ordinary CLI usage, or documented credential storage. No evidence found of malicious intent, unauthorized credential access, or prompt injection in SKILL.md. External CLI behavior and provider security claims cannot be verified from this documentation-only skill.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":9,"line_start":9},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":29,"line_start":27},{"file":"SKILL.md","line_end":38,"line_start":29},{"file":"SKILL.md","line_end":39,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":49,"line_start":48},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":57,"line_start":50},{"file":"SKILL.md","line_end":63,"line_start":57},{"file":"SKILL.md","line_end":64,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":68,"line_start":67},{"file":"SKILL.md","line_end":74,"line_start":68},{"file":"SKILL.md","line_end":81,"line_start":74},{"file":"SKILL.md","line_end":93,"line_start":81},{"file":"SKILL.md","line_end":95,"line_start":93},{"file":"SKILL.md","line_end":95,"line_start":95},{"file":"SKILL.md","line_end":104,"line_start":103},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":109,"line_start":108},{"file":"SKILL.md","line_end":113,"line_start":109},{"file":"SKILL.md","line_end":122,"line_start":113},{"file":"SKILL.md","line_end":127,"line_start":122},{"file":"SKILL.md","line_end":128,"line_start":127},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":135,"line_start":129},{"file":"SKILL.md","line_end":143,"line_start":135},{"file":"SKILL.md","line_end":144,"line_start":143},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":146,"line_start":146},{"file":"SKILL.md","line_end":147,"line_start":147},{"file":"SKILL.md","line_end":149,"line_start":148},{"file":"SKILL.md","line_end":149,"line_start":149},{"file":"SKILL.md","line_end":151,"line_start":150},{"file":"SKILL.md","line_end":155,"line_start":151},{"file":"SKILL.md","line_end":165,"line_start":155},{"file":"SKILL.md","line_end":169,"line_start":165},{"file":"SKILL.md","line_end":169,"line_start":169},{"file":"SKILL.md","line_end":180,"line_start":170},{"file":"SKILL.md","line_end":180,"line_start":180},{"file":"SKILL.md","line_end":197,"line_start":197},{"file":"SKILL.md","line_end":201,"line_start":201},{"file":"SKILL.md","line_end":204,"line_start":202}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":193,"line_start":193}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":201,"line_start":201},{"file":"SKILL.md","line_end":201,"line_start":201}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":206,"audit_model":"codex","audited_at":"2026-10-07T15:00:23.694+00:00","created_at":"2026-10-11T03:31:34.743764+00:00","static_findings":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`audio_url` for custom-voiceover lip-sync, or Seedance 2.0 Pro for","category":"external_commands","line_end":9,"severity":"medium","line_start":9},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"model. Calls `runcomfy run <vendor>/<model>/image-to-video` (or","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":29,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":38,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Animate **and** lip-sync to a **custom voiceover track** | **Wan 2.7 + `audio_url`** | Accepts you","category":"external_commands","line_end":39,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Multi-language dub variants (same image, different audio per call) | **Wan 2.7 + `audio_url`** | S","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **RunComfy CLI** — `npm i -g @runcomfy/cli`","category":"external_commands","line_end":49,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.","category":"external_commands","line_end":57,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `happyhorse/happyhorse-1-0/image-to-video` · **Arena rank**: #1 (Elo 1392)","category":"external_commands","line_end":63,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `image_url` | string | yes | — | JPEG/JPG/PNG/WEBP. Min 300px. Aspect 1:2.5–2.5:1. ≤10MB. |","category":"external_commands","line_end":64,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | ≤5000 non-CJK or 2500 CJK chars. **Motion / camera / lighting** desc","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `1080P` | `720P` or `1080P`. |","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | int | no | 5 | 3–15 seconds. |","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | 0 | Reuse for variant comparisons. |","category":"external_commands","line_end":68,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `watermark` | bool | no | true | Provider watermark toggle. |","category":"external_commands","line_end":74,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":81,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":93,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"## Route 2: Wan 2.7 + `audio_url` — when the user has a custom voiceover","category":"external_commands","line_end":95,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `wan-ai/wan-2-7/text-to-video` (NOT `/image-to-video` — Wan 2.7's t2v endpoint accepts an","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Up to ~5000 chars. Describe the talking-head shot: framing, lighting","category":"external_commands","line_end":104,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `audio_url` | string | yes (for lip-sync) | — | WAV/MP3, 3–30s, ≤15MB. **Drives lip-sync.** |","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `aspect_ratio` | enum | no | `16:9` | `16:9`, `9:16`, `1:1`, `4:3`, `3:4`. |","category":"external_commands","line_end":105,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `1080p` | `720p` or `1080p`. |","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | enum | no | `5` | 2–15 (whole seconds). Match your audio length. |","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `negative_prompt` | string | no | — | Concrete issues to avoid (e.g. \"no subtitles, no flicker\"). ","category":"external_commands","line_end":109,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | — | Reproducibility. |","category":"external_commands","line_end":113,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":122,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":127,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Match `duration` to audio length** — clip will be silent past the audio if too long.","category":"external_commands","line_end":128,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Use `negative_prompt` for issues**: `\"no subtitles, no flicker, no distorted hands\"`.","category":"external_commands","line_end":128,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **For multi-language dubs** — same prompt, swap `audio_url` per call. Lock seed for visual consist","category":"external_commands","line_end":135,"severity":"medium","line_start":129},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `bytedance/seedance-v2/pro`","category":"external_commands","line_end":143,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | CN ≤500 chars OR EN ≤1000 words. |","category":"external_commands","line_end":144,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `image_url` | array | yes (for i2v) | `[]` | 0–9 images. **First is the primary subject.** |","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video_url` | array | no | `[]` | 0–3 reference clips (MP4/MOV), 2–15s each. |","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `audio_url` | array | no | `[]` | 0–3 reference audio (WAV/MP3), 2–15s, < 15MB each. |","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `aspect_ratio` | enum | no | `adaptive` | `adaptive`, `16:9`, `9:16`, `4:3`, `3:4`, `1:1`, `21:9`.","category":"external_commands","line_end":147,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | int | no | 5 | 4–15 (whole seconds). |","category":"external_commands","line_end":149,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `720p` | `480p` or `720p`. |","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `generate_audio` | bool | no | true | In-pass synchronized speech / SFX / music. |","category":"external_commands","line_end":151,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | — | Reproducibility. |","category":"external_commands","line_end":155,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":165,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":169,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Image vs text division** — use `image_url` for what must stay stable (face, costume, brand); use","category":"external_commands","line_end":169,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Number the refs** in the prompt: `\"subject from image 1, lighting from video 1, voice from audio","category":"external_commands","line_end":180,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Brand-specific overrides** — if the user named a specific model variant not listed (e.g. Wan 2.6","category":"external_commands","line_end":180,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user inten","category":"external_commands","line_end":197,"severity":"medium","line_start":197},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"external_commands","line_end":201,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI d","category":"external_commands","line_end":204,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / ","category":"external_commands","line_end":204,"severity":"medium","line_start":204},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://www.runcomfy.com","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:77:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": \"https://.../portrait.jpg\",","category":"network","line_end":77,"severity":"low","line_start":77},{"id":"network:SKILL.md:117:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": \"https://.../voiceover-en.mp3\",","category":"network","line_end":117,"severity":"low","line_start":117},{"id":"network:SKILL.md:159:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image_url\": [\"https://.../subject.jpg\"],","category":"network","line_end":159,"severity":"low","line_start":159},{"id":"network:SKILL.md:160:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": [\"https://.../cafe-locked-shot.mp4\"],","category":"network","line_end":160,"severity":"low","line_start":160},{"id":"network:SKILL.md:161:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"audio_url\": [\"https://.../voice-tone.mp3\"],","category":"network","line_end":161,"severity":"low","line_start":161},{"id":"network:SKILL.md:193:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshootin","category":"network","line_end":193,"severity":"low","line_start":193},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"image_url\": \"https://.../portrait.jpg\",","category":"filesystem","line_end":77,"severity":"high","line_start":77},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"audio_url\": \"https://.../voiceover-en.mp3\",","category":"filesystem","line_end":117,"severity":"high","line_start":117},{"id":"filesystem:SKILL.md:159:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"image_url\": [\"https://.../subject.jpg\"],","category":"filesystem","line_end":159,"severity":"high","line_start":159},{"id":"filesystem:SKILL.md:160:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video_url\": [\"https://.../cafe-locked-shot.mp4\"],","category":"filesystem","line_end":160,"severity":"high","line_start":160},{"id":"filesystem:SKILL.md:161:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"audio_url\": [\"https://.../voice-tone.mp3\"],","category":"filesystem","line_end":161,"severity":"high","line_start":161},{"id":"filesystem:SKILL.md:201:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":201,"severity":"high","line_start":201},{"id":"filesystem:SKILL.md:201:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":201,"severity":"medium","line_start":201},{"id":"blocker:SKILL.md:108:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| `negative_prompt` | string | no | — | Concrete issues to avoid (e.g. \"no subtitles, no flicker\"). ","category":"blocker","line_end":108,"severity":"low","line_start":108}],"finding_verdicts":[{"id":"external_commands:SKILL.md:9:ruby-shell-backtick-execution","reason":"The backticks format the audio_url field name in Markdown. There is no Ruby expression or shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The inline code names the RunComfy command used for the requested animation workflow. Markdown backticks do not execute it.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"This opens a Markdown fence around a standard skill-install command. The fence is not shell backtick execution or evidence of malicious installation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"This closes the installation example's Markdown code fence. It is not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The table formats audio_url as a parameter name for voiceover lip-sync. It contains no shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks identify the audio_url parameter in a model-routing table. This is explanatory Markdown, not execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"This documents installing the named RunComfy CLI required by the workflow. No backtick execution or malicious package behavior is demonstrated here.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The inline command describes the intended account login flow. The Markdown does not execute a command or request credential disclosure.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"RUNCOMFY_TOKEN=<token> is a documented environment configuration placeholder. It is not shell substitution or a command to expose secrets.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks mark a model identifier in descriptive text. No executable expression appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"image_url is a field name in a parameter table. Markdown formatting is not Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"prompt is a documented string parameter with length limits. The backticks only format the parameter name.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The backticks delimit resolution and its allowed values in Markdown. They do not create executable substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"duration is a numeric parameter described in a Markdown table. No command execution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"seed is a parameter for comparing generation variants. Its inline formatting does not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"watermark is a boolean field in the model schema table. The backticks are Markdown syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"This opens a fenced RunComfy invocation example for the intended animation task. The sample uses quoted JSON and explicitly escapes its apostrophe.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This closes a Markdown command example. The delimiter is not shell backtick execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The heading formats audio_url as a field name. No executable command appears in the heading.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"Inline code distinguishes Wan endpoint identifiers and its audio parameter. These are explanatory strings, not shell substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"prompt is a schema field for describing the generated shot. Its Markdown formatting does not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"audio_url is documented as a media input with format and size limits. The backticks only identify its name.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The backticks mark aspect_ratio and literal ratio options. No command substitution or executable expression exists.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The table documents resolution values as inline code. This is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"duration and its default are formatted as model parameters. The row contains no executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"negative_prompt is a generation parameter with visual exclusion examples. Its backticks do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"seed is a generation parameter listed for reproducibility. The backticks are only inline Markdown formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"This opens a fenced Wan generation example using fixed, single-quoted JSON. There is no Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the Wan CLI example. It does not execute anything.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"The tip formats duration as a parameter name when discussing audio length. No shell code is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The inline text shows negative_prompt and a literal visual exclusion string. Both are Markdown examples, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:129:ruby-shell-backtick-execution","reason":"audio_url is formatted as a parameter in dubbing guidance. The text does not evaluate it as shell input.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"The backticks delimit the Seedance model identifier. A model name in prose is not an executable expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"prompt is a field in a table of model input limits. The inline code formatting has no execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The row documents image_url and an empty-array default. Markdown backticks do not execute these values.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"video_url and its empty-array default are parameter documentation. No shell command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"audio_url is a reference-media field shown with an empty-array default. Its backticks are Markdown, not code execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"The backticks format aspect_ratio and allowed literal values. There is no executable command or interpolation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"duration is a numeric model parameter in a Markdown table. The backticks only identify its name.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The row lists resolution and supported output sizes. None of its inline literals are executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"generate_audio is a boolean model option. Markdown formatting is not a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"seed is documented for generation reproducibility. No executable expression appears in this table row.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"This opens a fenced Seedance invocation with fixed, single-quoted JSON. The command serves the requested media workflow, not unrelated execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"This closes the Seedance Markdown command example. It is not shell command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"The tip distinguishes image_url from prompt as generation inputs. The backticks format field names, not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"This is an inline example of a model prompt referencing numbered media. It contains no shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The inline strings name related skills for explicit model requests. 'Overrides' refers to model selection, not overriding security instructions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:197:ruby-shell-backtick-execution","reason":"The paragraph documents the intended CLI workflow, output domains, and cancellation key. Its inline backticks are not executable substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"This documents login and the CLI's own credential path, with owner-only permissions. The backticks do not execute a command or read unrelated secrets.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"The backticks identify the --input CLI option in prose. This line makes a security claim, but contains no shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The inline strings name the intended API and output domains. They are documentation, not shell commands or evidence of unauthorized callbacks.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:17:hardcoded-url","reason":"This is the provider's homepage metadata. It does not send user data or credentials.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:23:hardcoded-url","reason":"These are provider, model, and repository links with campaign attribution parameters. The links contain no user content or secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:77:hardcoded-url","reason":"https://.../portrait.jpg is an illustrative media URL, not a real hardcoded recipient. The example supplies an image for the intended animation task.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:117:hardcoded-url","reason":"https://.../voiceover-en.mp3 is a placeholder for the user's voiceover input. It is not an exfiltration endpoint.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:159:hardcoded-url","reason":"https://.../subject.jpg is a placeholder image reference for Seedance. No real destination or unauthorized transmission is encoded.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:160:hardcoded-url","reason":"https://.../cafe-locked-shot.mp4 is an illustrative reference-video URL. Its documented purpose is the requested multimedia generation.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:161:hardcoded-url","reason":"https://.../voice-tone.mp3 is a placeholder audio reference. It does not identify a real external recipient for stolen data.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:193:hardcoded-url","reason":"This links to the provider's CLI troubleshooting documentation. The attribution query contains no credentials or private input.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:77:path-traversal-sequence","reason":"The apparent traversal sequence is inside the ellipsis host of https://.../portrait.jpg. This is a URL placeholder, not a filesystem traversal path.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:117:path-traversal-sequence","reason":"The dots belong to the placeholder URL https://.../voiceover-en.mp3. No filesystem path or parent-directory access is requested.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:159:path-traversal-sequence","reason":"The sequence comes from the ellipsis host in an example image URL. There is no filesystem traversal operation.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:160:path-traversal-sequence","reason":"The dots abbreviate the host of a reference-video URL. They are not parent-directory segments in a local file path.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:161:path-traversal-sequence","reason":"The matched sequence is part of https://.../voice-tone.mp3, an illustrative URL. No filesystem traversal behavior is shown.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:201:hidden-file-in-home-directory","reason":"The path is the RunComfy CLI's documented credential store after login, with mode 0600. No unrelated secret access or hidden persistence is instructed.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:201:hidden-file-access","reason":"This explains legitimate storage of the application's own API token and an environment-variable alternative. It does not direct secret harvesting.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:108:system-reconnaissance","reason":"The row describes negative_prompt exclusions such as no subtitles and no flicker. It contains no system inspection or reconnaissance command.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","subject_content_hash":"7a97ff688209d3cad39a9d84b284b209c3b3cdcc775fb91b4711b2eb1555ad7b","subject_tree_hash":"9c50b2b32907fb02cb6ae3b02f8a7328ca6eaf4054b376100afa5591b5492007","subject_plugin_path":"skills/gencraft-labs/image-to-video","audit_payload_hash":"c1f478e668d7badd6ccbd4bcddee561e","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","contentHash":"7a97ff688209d3cad39a9d84b284b209c3b3cdcc775fb91b4711b2eb1555ad7b","treeHash":"9c50b2b32907fb02cb6ae3b02f8a7328ca6eaf4054b376100afa5591b5492007","pluginPath":"skills/gencraft-labs/image-to-video","auditPayloadHash":"c1f478e668d7badd6ccbd4bcddee561e"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/gencraft-labs-image-to-video/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}