{"data":{"skill":{"slug":"gencraft-labs-video-edit","name":"video-edit","icon":"📦","repo":"https://github.com/gencraft-labs/skills/tree/5d625f59c710d7a33316b50b302b7158cdee5971/video-edit","status":"approved","author":"gencraft-labs","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"592e0e85-6d45-4047-af7a-2b29b9da6dbe","skill_id":"74c9ace1-7e0b-43c8-8f23-a7dbc7333bc5","version":1,"content_hash":"v3:e406bf64b5db6e514879399e87b346fa7ff7c2fb:e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44:fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1:736b696c6c732f67656e63726166742d6c6162732f766964656f2d65646974:223f7f47658c248f4ffd706d0a885604","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 67 static findings are false positives involving Markdown formatting, illustrative URLs, legitimate CLI workflows, or documented token storage. No evidence found of malicious intent, credential theft, or prompt injection in SKILL.md. Remote processing and local downloads are disclosed, but external CLI behavior and security claims were not independently verified.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":29,"line_start":27},{"file":"SKILL.md","line_end":37,"line_start":29},{"file":"SKILL.md","line_end":49,"line_start":37},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":58,"line_start":51},{"file":"SKILL.md","line_end":64,"line_start":58},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":85,"line_start":77},{"file":"SKILL.md","line_end":89,"line_start":85},{"file":"SKILL.md","line_end":98,"line_start":89},{"file":"SKILL.md","line_end":102,"line_start":98},{"file":"SKILL.md","line_end":104,"line_start":102},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":105},{"file":"SKILL.md","line_end":120,"line_start":112},{"file":"SKILL.md","line_end":121,"line_start":120},{"file":"SKILL.md","line_end":122,"line_start":121},{"file":"SKILL.md","line_end":123,"line_start":122},{"file":"SKILL.md","line_end":124,"line_start":123},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":138,"line_start":128},{"file":"SKILL.md","line_end":143,"line_start":138},{"file":"SKILL.md","line_end":145,"line_start":143},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":159,"line_start":151},{"file":"SKILL.md","line_end":160,"line_start":159},{"file":"SKILL.md","line_end":161,"line_start":160},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":174,"line_start":167},{"file":"SKILL.md","line_end":178,"line_start":174},{"file":"SKILL.md","line_end":185,"line_start":178},{"file":"SKILL.md","line_end":190,"line_start":185},{"file":"SKILL.md","line_end":200,"line_start":190},{"file":"SKILL.md","line_end":217,"line_start":200},{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":221,"line_start":221},{"file":"SKILL.md","line_end":224,"line_start":222},{"file":"SKILL.md","line_end":224,"line_start":224}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":213,"line_start":213}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":221,"line_start":221},{"file":"SKILL.md","line_end":221,"line_start":221}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":226,"audit_model":"codex","audited_at":"2026-10-08T15:08:45.243+00:00","created_at":"2026-10-11T03:31:41.840051+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"on the wrong model. Calls `runcomfy run <vendor>/<model>/<endpoint>`","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":29,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Replace packaging design using a reference image | **Wan 2.7 Edit-Video** + `reference_image` | Re","category":"external_commands","line_end":49,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **RunComfy CLI** — `npm i -g @runcomfy/cli`","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **RunComfy account** — `runcomfy login`.","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.","category":"external_commands","line_end":58,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `wan-ai/wan-2-7/edit-video`","category":"external_commands","line_end":64,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Lead with preservation. One edit direction per call. |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video` | string | yes | — | MP4/MOV URL, 2–10s, ≤100MB. |","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `reference_image` | string | no | — | URL — use for direct design / appearance transfer only. |","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | (input) | `720p` or `1080p`. |","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `aspect_ratio` | enum | no | (input) | W:H. Defaults to input. |","category":"external_commands","line_end":69,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | int | no | 0 | `0` = match input; `2–10` = truncate from start. |","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `audio_setting` | enum | no | `auto` | `auto` or `origin` (preserve source audio). |","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | — | Reproducibility. |","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":98,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":102,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Preservation goals first**: `\"Preserve [face / pose / motion / framing / lip movement]; [then st","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`reference_image` only when justified** (packaging swap, costume swap with target visual). Don't","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`audio_setting: \"origin\"`** for talking-head where you don't want soundtrack regenerated.","category":"external_commands","line_end":112,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `kling/kling-2-6/motion-control-pro`","category":"external_commands","line_end":120,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | Describe target motion / style. |","category":"external_commands","line_end":121,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `image` | string | yes (image orientation) | Reference for character / background consistency. |","category":"external_commands","line_end":122,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video` | string | yes | **Motion reference**. 10–30s depending on orientation. |","category":"external_commands","line_end":123,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keep_original_sound` | bool | no | Preserve audio from reference video. |","category":"external_commands","line_end":124,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `character_orientation` | enum | yes | `image` (max 10s output) or `video` (max 30s output). |","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":138,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Spatial constraints help**: `\"character on left side, background motion right\"`.","category":"external_commands","line_end":145,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`character_orientation: \"image\"`** caps output at 10s; `\"video\"` allows 30s.","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `decart/lucy-edit/restyle`","category":"external_commands","line_end":159,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Natural-language edit instruction. |","category":"external_commands","line_end":160,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video_url` | string | yes | — | MP4/MOV/WEBM/GIF. |","category":"external_commands","line_end":161,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `720p` | `720p` only on this tier. |","category":"external_commands","line_end":161,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":174,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":185,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Preserve identity goals** — `\"preserve face and motion\"` is enough; don't over-specify.","category":"external_commands","line_end":200,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Brand-specific overrides** — if the user named a specific model, route to the corresponding bran","category":"external_commands","line_end":217,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill picks one of Wan 2.7 Edit-Video / Kling 2.6 Pro Motion Control / Lucy Edit Restyle based o","category":"external_commands","line_end":217,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"external_commands","line_end":221,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI d","category":"external_commands","line_end":224,"severity":"medium","line_start":222},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / ","category":"external_commands","line_end":224,"severity":"medium","line_start":224},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://www.runcomfy.com","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-ed","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../speaker.mp4\",","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../hand-holding-package.mp4\",","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"network:SKILL.md:94:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"reference_image\": \"https://.../new-packaging.png\",","category":"network","line_end":94,"severity":"low","line_start":94},{"id":"network:SKILL.md:132:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image\": \"https://.../target-character.jpg\",","category":"network","line_end":132,"severity":"low","line_start":132},{"id":"network:SKILL.md:133:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../motion-reference-dance.mp4\",","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:SKILL.md:171:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://.../subject-walking.mp4\"","category":"network","line_end":171,"severity":"low","line_start":171},{"id":"network:SKILL.md:182:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://.../subject-portrait.mp4\"","category":"network","line_end":182,"severity":"low","line_start":182},{"id":"network:SKILL.md:213:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshootin","category":"network","line_end":213,"severity":"low","line_start":213},{"id":"filesystem:SKILL.md:81:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../speaker.mp4\",","category":"filesystem","line_end":81,"severity":"high","line_start":81},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../hand-holding-package.mp4\",","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"reference_image\": \"https://.../new-packaging.png\",","category":"filesystem","line_end":94,"severity":"high","line_start":94},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"image\": \"https://.../target-character.jpg\",","category":"filesystem","line_end":132,"severity":"high","line_start":132},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../motion-reference-dance.mp4\",","category":"filesystem","line_end":133,"severity":"high","line_start":133},{"id":"filesystem:SKILL.md:171:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video_url\": \"https://.../subject-walking.mp4\"","category":"filesystem","line_end":171,"severity":"high","line_start":171},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video_url\": \"https://.../subject-portrait.mp4\"","category":"filesystem","line_end":182,"severity":"high","line_start":182},{"id":"filesystem:SKILL.md:221:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":221,"severity":"high","line_start":221},{"id":"filesystem:SKILL.md:221:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":221,"severity":"medium","line_start":221},{"id":"blocker:SKILL.md:191:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid total replacement** (\"astronaut in space\" works; \"swap subject for a different person\" doe","category":"blocker","line_end":191,"severity":"low","line_start":191}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"Backticks mark the intended RunComfy command as inline Markdown. This is a documented editing workflow, not Ruby execution or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The triple backticks open a Bash example for installing the named skill. They are Markdown delimiters, not executable backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"This line closes the installation example with a Markdown code fence. The delimiter does not execute any command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks format the reference_image parameter in a model selection table. No shell or Ruby execution appears in this entry.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The npm command documents installation of the CLI required for the advertised service. Markdown backticks are not command substitution; dependency safety is outside this source review.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The inline command documents normal account login for RunComfy. No unrelated execution or credential forwarding instruction appears here.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"RUNCOMFY_TOKEN is documented as a configuration variable with a placeholder value. This line neither executes a shell substitution nor exposes an actual token.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks format the Wan model identifier. It is a literal endpoint name, not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The prompt field is formatted as inline code in a parameter table. This is schema documentation without shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"The video field describes supported input formats and limits. Its Markdown backticks do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The reference_image field is a documented optional parameter. No shell evaluation or Ruby code appears in the table row.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Backticks format resolution and its allowed values. These literal parameter values are not commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The aspect_ratio row documents an input field and its default behavior. The backticks are Markdown formatting only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"Backticks surround duration and numeric values in a schema table. There is no execution expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The audio_setting row documents literal audio preservation options. Markdown code spans do not create command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The seed parameter is documented for reproducibility. Its inline formatting is not a shell or Ruby expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The code fence introduces a RunComfy background editing example with single-quoted JSON. No executable backtick substitution appears in the command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the background editing example. It is not an execution operation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The fence introduces the advertised packaging edit command using literal JSON parameters. The fence itself does not execute shell substitutions.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"This line closes the packaging edit example. Triple backticks are Markdown syntax, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The backticks enclose a natural-language preservation prompt example. It is model prompting guidance, not an executable expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"The reference_image code span names a parameter in usage guidance. No command execution occurs.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"The inline text specifies the origin audio setting. It is a JSON parameter example, not shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"Backticks format the Kling model identifier. A literal model name is not executable Ruby or shell code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The prompt row documents a required model input. Markdown formatting is the only backtick usage.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The image row describes the character reference parameter. It contains no execution construct.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The video field documents the motion reference input and duration guidance. The backticks are not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"The keep_original_sound row describes a Boolean input. No shell or Ruby command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"Backticks mark character_orientation and its literal options. These are model parameters, not executable expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The Markdown fence introduces the expected Kling motion control command with single-quoted JSON. No backtick evaluation or unrelated command appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This line closes the Kling command example. It is a Markdown delimiter, not executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"The code span contains a natural-language spatial constraint example. It does not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The backticks format character orientation values and their output duration limits. No command execution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The Lucy model identifier is a literal Markdown code span. It is not shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The prompt field is documented in the Lucy schema table. Its backticks serve only as formatting.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"The video_url row lists supported media formats. No executable command appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"Backticks format the resolution field and the 720p limit. These are literal schema values.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The code fence introduces a normal Lucy outfit editing example. The command uses literal JSON and contains no executable backticks.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"This is the closing Markdown fence for the outfit example. It does not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The code fence introduces the advertised Lucy lighting edit command. No backtick substitution is present in the example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"This line closes the lighting edit example with a Markdown fence. The fence is not executable.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The backticks format a preservation instruction for the editing model. Natural-language prompt text is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"The code span names a related model skill for explicit model requests. It is a routing reference, not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"This prose describes the intended CLI request, polling, and output download workflow. The inline backticks are Markdown, not Ruby or shell evaluation.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"Backticks format the login command, token path, and environment variable. The line documents authentication storage rather than executing shell substitutions.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","reason":"The --input code span names a CLI argument in security documentation. No executable backticks appear; the external CLI implementation was not reviewed.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Backticks format the declared API and output download domains. Domain names in prose do not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The URL is homepage metadata for the advertised RunComfy service. It contains no secret or automatic exfiltration instruction.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:23:hardcoded-url","reason":"These are public service, model, and repository links. Their campaign parameters are static attribution values, not user data or credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:81:hardcoded-url","reason":"The speaker video URL uses an ellipsis placeholder in a documented editing request. It is not a concrete destination for covert transmission.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:93:hardcoded-url","reason":"The packaging video URL is an illustrative placeholder for the requested source media. It does not identify a hidden recipient.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:94:hardcoded-url","reason":"The reference image URL is a placeholder for an explicitly required design asset. No credential or unrelated data transfer appears.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:132:hardcoded-url","reason":"The target character image URL is an example input placeholder. It is not a hardcoded operational recipient.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:133:hardcoded-url","reason":"The motion reference video URL is an illustrative model input. The surrounding command performs the advertised motion transfer.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:171:hardcoded-url","reason":"The walking video URL is a placeholder for user-selected source media. No hidden network destination or exfiltration payload is present.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:182:hardcoded-url","reason":"The portrait video URL is an example placeholder used for lighting edits. It does not embed secrets or a concrete suspicious endpoint.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:213:hardcoded-url","reason":"The URL links to public CLI troubleshooting documentation. Static campaign parameters do not contain user data.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:81:path-traversal-sequence","reason":"The matched dots belong to an ellipsis placeholder in an HTTPS video URL. This is not a filesystem parent-directory traversal.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","reason":"The three dots are a placeholder hostname in an example video URL. No filesystem path traversal is requested.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","reason":"The image URL contains an ellipsis placeholder rather than a parent-directory path. The example does not access local files.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","reason":"The three dots stand for a media host in an illustrative HTTPS URL. They do not traverse a filesystem directory.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","reason":"The matched sequence appears in the placeholder hostname of a motion reference URL. It is not a local traversal operation.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:171:path-traversal-sequence","reason":"The ellipsis belongs to an example source URL. No parent-directory path or local file access appears.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","reason":"The portrait URL uses a placeholder hostname containing three dots. This is illustrative URL text, not filesystem traversal.","verdict":"false_positive","confidence":1},{"id":"filesystem:SKILL.md:221:hidden-file-in-home-directory","reason":"The path is documented as the CLI's own authentication store with owner-only permissions. No unrelated credential access is instructed; permissions were not independently verified.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:SKILL.md:221:hidden-file-access","reason":"This documents normal token storage under the application's configuration directory. No instruction reads or exports another application's hidden files.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:191:system-reconnaissance","reason":"The line explains that Lucy cannot fully replace a video subject. It contains no system inspection, host enumeration, or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","subject_content_hash":"e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44","subject_tree_hash":"fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1","subject_plugin_path":"skills/gencraft-labs/video-edit","audit_payload_hash":"223f7f47658c248f4ffd706d0a885604","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","contentHash":"e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44","treeHash":"fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1","pluginPath":"skills/gencraft-labs/video-edit","auditPayloadHash":"223f7f47658c248f4ffd706d0a885604"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/gencraft-labs-video-edit/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}