{"data":{"skill":{"slug":"prime-skills-video-inpainting","name":"video-inpainting","icon":"📦","repo":"https://github.com/prime-skills/runcomfy-agent-skills/tree/fca19ae084c2ae4667f5c8affbb99da5103d5832/video-inpainting","status":"approved","author":"prime-skills","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"36e58ba1-70be-48e3-8938-ad403a9912f3","skill_id":"db0edbcb-c81c-4f55-bf33-82c883720f1b","version":1,"content_hash":"v3:a53bacaa2e85e44d9f929fa7a6d863cbe7fd1c03:e92fad51debfeee3bbc1bd355a227fae0ea4418cd47f4081c3118c956ff5511f:67e4e7cd0854db094b314c7dcf7bccf19f270d35871979de5ad98769b6383b76:736b696c6c732f7072696d652d736b696c6c732f766964656f2d696e7061696e74696e67:fd89febbe6bfd04a17c6610066a5ba39","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 57 static findings are false positives involving Markdown, reference URLs, standard authentication documentation, or model-selection advice. One semantic concern remains: the guide incorrectly treats JSON input as protection against shell injection during command construction. No evidence found of malicious instructions, credential exfiltration, or security-review manipulation; external CLI behavior was not verified.","remediation":[{"issue":"The shell-safety guarantee omits quoting requirements for user-provided prompts and URLs.","severity":"medium","suggestion":"Remove the absolute guarantee and document structured JSON serialization with argument-array execution or supported file input, without interpolating untrusted text into shell commands."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":6,"line_start":6},{"file":"SKILL.md","line_end":43,"line_start":32},{"file":"SKILL.md","line_end":45,"line_start":43},{"file":"SKILL.md","line_end":53,"line_start":45},{"file":"SKILL.md","line_end":58,"line_start":53},{"file":"SKILL.md","line_end":63,"line_start":58},{"file":"SKILL.md","line_end":72,"line_start":63},{"file":"SKILL.md","line_end":77,"line_start":72},{"file":"SKILL.md","line_end":84,"line_start":77},{"file":"SKILL.md","line_end":88,"line_start":84},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":92,"line_start":89},{"file":"SKILL.md","line_end":102,"line_start":92},{"file":"SKILL.md","line_end":103,"line_start":102},{"file":"SKILL.md","line_end":104,"line_start":103},{"file":"SKILL.md","line_end":118,"line_start":104},{"file":"SKILL.md","line_end":126,"line_start":118},{"file":"SKILL.md","line_end":127,"line_start":126},{"file":"SKILL.md","line_end":128,"line_start":127},{"file":"SKILL.md","line_end":136,"line_start":128},{"file":"SKILL.md","line_end":155,"line_start":136},{"file":"SKILL.md","line_end":159,"line_start":155},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":165,"line_start":161},{"file":"SKILL.md","line_end":165,"line_start":165},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":172,"line_start":171},{"file":"SKILL.md","line_end":173,"line_start":172},{"file":"SKILL.md","line_end":174,"line_start":173},{"file":"SKILL.md","line_end":175,"line_start":174}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":105,"line_start":105},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":127,"line_start":127},{"file":"SKILL.md","line_end":128,"line_start":128},{"file":"SKILL.md","line_end":134,"line_start":134},{"file":"SKILL.md","line_end":135,"line_start":135},{"file":"SKILL.md","line_end":136,"line_start":136},{"file":"SKILL.md","line_end":151,"line_start":151},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":172,"line_start":172},{"file":"SKILL.md","line_end":173,"line_start":173},{"file":"SKILL.md","line_end":174,"line_start":174},{"file":"SKILL.md","line_end":175,"line_start":175}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":160,"line_start":160},{"file":"SKILL.md","line_end":160,"line_start":160}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Shell Safety Claim Omits Caller-Side Quoting","locations":[{"file":"SKILL.md","line_end":84,"line_start":77},{"file":"SKILL.md","line_end":161,"line_start":161}],"confidence":0.85,"description":"The guide claims \"No shell-injection surface\" while placing user prompts and URLs inside shell-single-quoted JSON. An unescaped apostrophe can end that quoting before the CLI receives input; JSON does not protect the invoking shell.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The example and absolute safety claim are visible, but no CLI implementation or dynamically assembled command is included. Exploitability depends on how an agent inserts user input."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":176,"audit_model":"codex","audited_at":"2026-11-01T14:41:03.372+00:00","created_at":"2026-11-01T15:30:19.259298+00:00","static_findings":[{"id":"external_commands:SKILL.md:6:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Region edits across video frames on RunComfy via the `runcomfy`","category":"external_commands","line_end":6,"severity":"medium","line_start":6},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":43,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-c","category":"external_commands","line_end":53,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Wan 2-7 Edit-Video** — `wan-ai/wan-2-7/edit-video` *(default)*","category":"external_commands","line_end":58,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Lucy Edit Restyle** — `decart/lucy-edit/restyle`","category":"external_commands","line_end":63,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Seedream 4-0 Edit-Sequential** — [`bytedance/seedream-4-0/edit-sequential`](https://www.runcomfy.c","category":"external_commands","line_end":72,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `wan-ai/wan-2-7/edit-video`","category":"external_commands","line_end":77,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":84,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":88,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Describe the region in spatial language** — `\"bottom-right corner\"`, `\"the cables overhead\"`, `\"","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Lead with preservation**: `\"Preserve all other content exactly\"` — without this Wan may restyle ","category":"external_commands","line_end":92,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For broader video edit, see [`video-edit`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills","category":"external_commands","line_end":102,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| LTX 2-3 video inpaint (targeted frame editing) | `ltx-2-3-inpaint-in-comfyui-targeted-video-frame-","category":"external_commands","line_end":103,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Flux inpainting (still) — chain frame-by-frame | `comfyui-flux-inpainting-workflow` |","category":"external_commands","line_end":104,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Flux ControlNet inpainting | `flux-controlnet-inpainting-image-repair` |","category":"external_commands","line_end":118,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Wan 2-7 Edit-Video** with `\"remove the person walking in the background, fill with matching envi","category":"external_commands","line_end":126,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Image inpainting** (single still): see [`image-inpainting`](https://www.skills.sh/agentspace-so/","category":"external_commands","line_end":127,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Video outpainting** (canvas expansion): see [`video-outpainting`](https://www.skills.sh/agentspa","category":"external_commands","line_end":128,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Full video restyle / motion transfer**: see [`video-edit`](https://www.skills.sh/agentspace-so/r","category":"external_commands","line_end":136,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`wan-models`](https://www.runcomfy.com/models/collections/wan-models?utm_source=skills.sh&utm_med","category":"external_commands","line_end":155,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill picks Wan 2-7 Edit-Video (default for prompt-driven region edits) or one of the alternativ","category":"external_commands","line_end":159,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/c","category":"external_commands","line_end":159,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"external_commands","line_end":160,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Input boundary (shell injection)**: prompts and video URLs are passed as a JSON string via `--in","category":"external_commands","line_end":165,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` and `*.runcomfy.net` / `*.runcom","category":"external_commands","line_end":165,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Scope of bash usage**: `Bash(runcomfy *)` only.","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) — the und","category":"external_commands","line_end":172,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`video-edit`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/video-edit) — full video-","category":"external_commands","line_end":173,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`image-inpainting`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/image-inpainting) —","category":"external_commands","line_end":174,"severity":"medium","line_start":173},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- [`video-outpainting`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/video-outpainting)","category":"external_commands","line_end":175,"severity":"medium","line_start":174},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://www.runcomfy.com","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:28:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-in","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"network:SKILL.md:45:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-c","category":"network","line_end":45,"severity":"low","line_start":45},{"id":"network:SKILL.md:63:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Seedream 4-0 Edit-Sequential** — [`bytedance/seedream-4-0/edit-sequential`](https://www.runcomfy.c","category":"network","line_end":63,"severity":"low","line_start":63},{"id":"network:SKILL.md:73:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Catalog**: [Wan 2-7 edit-video](https://www.runcomfy.com/models/wan-ai/wan-2-7/edit?utm_source=ski","category":"network","line_end":73,"severity":"low","line_start":73},{"id":"network:SKILL.md:80:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://your-cdn.example/source.mp4\",","category":"network","line_end":80,"severity":"low","line_start":80},{"id":"network:SKILL.md:92:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"For broader video edit, see [`video-edit`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills","category":"network","line_end":92,"severity":"low","line_start":92},{"id":"network:SKILL.md:105:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"| Wan 2-2 video edit (broader video edit including inpaint) | search [comfyui-workflows](https://www","category":"network","line_end":105,"severity":"low","line_start":105},{"id":"network:SKILL.md:115:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- If quality not enough: open [LTX 2-3 inpaint workflow](https://www.runcomfy.com/comfyui-workflows/","category":"network","line_end":115,"severity":"low","line_start":115},{"id":"network:SKILL.md:126:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Image inpainting** (single still): see [`image-inpainting`](https://www.skills.sh/agentspace-so/","category":"network","line_end":126,"severity":"low","line_start":126},{"id":"network:SKILL.md:127:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Video outpainting** (canvas expansion): see [`video-outpainting`](https://www.skills.sh/agentspa","category":"network","line_end":127,"severity":"low","line_start":127},{"id":"network:SKILL.md:128:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Full video restyle / motion transfer**: see [`video-edit`](https://www.skills.sh/agentspace-so/r","category":"network","line_end":128,"severity":"low","line_start":128},{"id":"network:SKILL.md:134:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [All video models](https://www.runcomfy.com/models?utm_source=skills.sh&utm_medium=skill&utm_campa","category":"network","line_end":134,"severity":"low","line_start":134},{"id":"network:SKILL.md:135:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [ComfyUI workflows — \"inpaint\" search](https://www.runcomfy.com/comfyui-workflows?utm_source=skill","category":"network","line_end":135,"severity":"low","line_start":135},{"id":"network:SKILL.md:136:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`wan-models`](https://www.runcomfy.com/models/collections/wan-models?utm_source=skills.sh&utm_med","category":"network","line_end":136,"severity":"low","line_start":136},{"id":"network:SKILL.md:151:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshootin","category":"network","line_end":151,"severity":"low","line_start":151},{"id":"network:SKILL.md:171:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) — the und","category":"network","line_end":171,"severity":"low","line_start":171},{"id":"network:SKILL.md:172:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`video-edit`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/video-edit) — full video-","category":"network","line_end":172,"severity":"low","line_start":172},{"id":"network:SKILL.md:173:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`image-inpainting`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/image-inpainting) —","category":"network","line_end":173,"severity":"low","line_start":173},{"id":"network:SKILL.md:174:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`video-outpainting`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/video-outpainting)","category":"network","line_end":174,"severity":"low","line_start":174},{"id":"network:SKILL.md:175:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [`ai-video-generation`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/ai-video-generat","category":"network","line_end":175,"severity":"low","line_start":175},{"id":"filesystem:SKILL.md:160:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":160,"severity":"high","line_start":160},{"id":"filesystem:SKILL.md:160:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":160,"severity":"medium","line_start":160},{"id":"blocker:SKILL.md:56:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> Avoid for: precise pixel-level region targeting — use a ComfyUI workflow.","category":"blocker","line_end":56,"severity":"low","line_start":56},{"id":"blocker:SKILL.md:61:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> Avoid for: surgical mask-driven inpaint — ComfyUI workflow.","category":"blocker","line_end":61,"severity":"low","line_start":61},{"id":"blocker:SKILL.md:66:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"> Avoid for: long clips, motion-coherent fills — temporal consistency degrades.","category":"blocker","line_end":66,"severity":"low","line_start":66}],"finding_verdicts":[{"id":"external_commands:SKILL.md:6:ruby-shell-backtick-execution","reason":"The backticks format the CLI name in YAML description text. They do not execute shell or Ruby code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This is a Markdown fence around installation, authentication, and model invocation examples. No Ruby backtick execution or shell command substitution appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The matched backticks close a Markdown code fence. The following line is a reference link, not executable substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"Backticks format a linked skill name and a model identifier. Neither is evaluated as code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The matched text is an inline-formatted Wan model identifier in model-selection documentation. It is not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks format the Lucy model identifier in prose. No executable command substitution is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The match spans inline-formatted Seedream and Wan identifiers in model documentation. These are Markdown labels, not executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"This line names the selected model using inline Markdown. The subsequent backticks begin a code fence rather than command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"A Markdown fence surrounds the intended RunComfy video-edit command. Shell-safe construction of dynamic input is assessed separately, not as Ruby backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The match starts at a closing Markdown fence and extends to inline-formatted prompting examples. Neither represents executable backticks.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"Backticks highlight spatial phrases such as bottom-right corner. These are model prompt examples, not shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The quoted preservation instruction targets video-editing behavior. Markdown formatting and the following reference link do not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The backticks label a related skill and a workflow identifier. This is navigation and model documentation, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The table formats workflow identifiers as inline code. It contains no shell substitution or Ruby evaluation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The Flux workflow names are Markdown table labels. Backticks are presentational and do not invoke those workflows.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"This is an inline workflow identifier followed by workflow guidance and an example edit prompt. No executable backtick syntax appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The match highlights a natural-language object-removal prompt and a related skill label. These are documentation, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"Inline backticks label links to related image-inpainting and video-outpainting skills. They do not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"This match spans related-skill link labels in a scope description. Markdown formatting is not command substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"The backticks format related-skill and model-collection labels. No execution mechanism is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"This span contains a model-collection link and an inline CLI option name. Neither is executable backtick syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"Backticks mark an output-directory option and package-manager examples in prose. The documented CLI workflow is intentional, not hidden Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The inline commands document installing the named CLI package and explicitly prohibit piping arbitrary remote scripts into a shell. No backtick execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"Backticks format the login command, token path, and environment variable. This line documents authentication storage rather than executing substitutions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"Backticks format the input option and endpoint names in security guidance. The inaccurate shell-safety assurance is a separate semantic concern.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"Inline code formatting identifies stated outbound endpoint domains. There is no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The backticks format the declared Bash tool scope and a related-skill label. This is permission documentation, not shell substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"The matched backticks format related CLI and video-edit skill links. These navigation labels do not execute code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"This is a related-skill list using inline code labels. No Ruby or shell command substitution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:173:ruby-shell-backtick-execution","reason":"The backticks label image-inpainting and video-outpainting reference links. They are Markdown, not executable expressions.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The match covers related video-outpainting and video-generation link labels. No command is executed by these backticks.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:20:hardcoded-url","reason":"The URL is homepage metadata for the named service. It does not transmit data or instruct an unauthorized request.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:28:hardcoded-url","reason":"These are service, model-catalog, and documentation links with campaign parameters. No secrets or local data are embedded in the URLs.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:45:hardcoded-url","reason":"This is a reference link to the related CLI skill. It does not instruct credential transmission or remote script execution.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:63:hardcoded-url","reason":"The URL links to the Seedream model catalog entry used for route selection. No sensitive data is included.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:73:hardcoded-url","reason":"The URL is the catalog reference for the documented Wan model. It is not an exfiltration destination in this text.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:80:hardcoded-url","reason":"The video URL uses the reserved .example domain as a placeholder. It does not identify an operational attacker-controlled endpoint.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:92:hardcoded-url","reason":"The URL links to a related video-editing skill for broader edits. No data upload or secret disclosure is requested.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:105:hardcoded-url","reason":"This link opens the service workflow catalog for manual searching. It does not execute a remote workflow or send user files.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:115:hardcoded-url","reason":"The URL points to a relevant mask-driven workflow page. Opening that reference is distinct from transmitting a source video.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:126:hardcoded-url","reason":"The link identifies an image-inpainting skill outside this skill's scope. No unauthorized network operation is described.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:127:hardcoded-url","reason":"The URL is a related video-outpainting skill reference. It does not carry credentials or local file content.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:128:hardcoded-url","reason":"This link redirects readers to broader video-edit guidance. It is documentation rather than evidence of malicious networking.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:134:hardcoded-url","reason":"The URL opens the service model catalog with campaign parameters. It contains no user data or executable payload.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:135:hardcoded-url","reason":"The workflow catalog link supports manual selection of masking workflows. No hidden upload or code execution is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:136:hardcoded-url","reason":"The URL identifies the Wan model collection. Its campaign parameters are static attribution values, not extracted secrets.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:151:hardcoded-url","reason":"The URL is a CLI troubleshooting reference adjacent to exit-code documentation. No sensitive information is transmitted by the supplied text.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:171:hardcoded-url","reason":"The link points to the underlying CLI skill as related documentation. It does not direct execution of downloaded code.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:172:hardcoded-url","reason":"The URL references the related video-edit router skill. No unauthorized data transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:173:hardcoded-url","reason":"The URL is a related image-inpainting skill reference. There is no embedded credential or upload instruction.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:174:hardcoded-url","reason":"The link identifies a related video-outpainting skill. It is navigational documentation, not an exfiltration request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:175:hardcoded-url","reason":"This is a reference to a related video-generation skill. The URL contains no local data or credential material.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:160:hidden-file-in-home-directory","reason":"The path documents the CLI's own authentication token storage with stated mode 0600. It does not request unrelated secret access or credential disclosure.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:160:hidden-file-access","reason":"This line describes normal application configuration storage after login. No instruction reads, prints, or exports the token file.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:56:system-reconnaissance","reason":"The line advises against this model for precise pixel targeting. It contains no host discovery, system inspection, or reconnaissance command.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:61:system-reconnaissance","reason":"The text discusses mask-driven inpainting limitations and recommends a workflow. It does not inspect the operating system or environment.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:66:system-reconnaissance","reason":"This is a warning about temporal consistency in long clips. No system reconnaissance behavior is present.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Shell Safety Claim Omits Caller-Side Quoting","severity":"medium","locations":[{"file":"SKILL.md","line_end":84,"line_start":77},{"file":"SKILL.md","line_end":161,"line_start":161}],"confidence":0.85,"description":"The guide claims \"No shell-injection surface\" while placing user prompts and URLs inside shell-single-quoted JSON. An unescaped apostrophe can end that quoting before the CLI receives input; JSON does not protect the invoking shell.","confidence_reasoning":"The example and absolute safety claim are visible, but no CLI implementation or dynamically assembled command is included. Exploitability depends on how an agent inserts user input."}],"subject_marketplace_commit_sha":"a53bacaa2e85e44d9f929fa7a6d863cbe7fd1c03","subject_content_hash":"e92fad51debfeee3bbc1bd355a227fae0ea4418cd47f4081c3118c956ff5511f","subject_tree_hash":"67e4e7cd0854db094b314c7dcf7bccf19f270d35871979de5ad98769b6383b76","subject_plugin_path":"skills/prime-skills/video-inpainting","audit_payload_hash":"fd89febbe6bfd04a17c6610066a5ba39","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"a53bacaa2e85e44d9f929fa7a6d863cbe7fd1c03","contentHash":"e92fad51debfeee3bbc1bd355a227fae0ea4418cd47f4081c3118c956ff5511f","treeHash":"67e4e7cd0854db094b314c7dcf7bccf19f270d35871979de5ad98769b6383b76","pluginPath":"skills/prime-skills/video-inpainting","auditPayloadHash":"fd89febbe6bfd04a17c6610066a5ba39"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/prime-skills-video-inpainting/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}