{"data":{"skill":{"slug":"skills-collective-video-edit","name":"video-edit","icon":"📦","repo":"https://github.com/skills-collective/skills/tree/main/video-edit/","status":"approved","author":"skills-collective","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"75d148b6-26a8-4a80-86be-5b2289316e35","skill_id":"b8ce67ef-fb5c-42a0-96fa-26bfd01cd719","version":4,"content_hash":"v3:9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2:e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44:fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1:736b696c6c732f736b696c6c732d636f6c6c6563746976652f766964656f2d65646974:672b73e714b0441b8bc085e5d4927d59","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 67 static findings are false positives caused by Markdown formatting, example URLs, or documentation of credential storage. Separate review found shell-construction, unpinned dependency, and third-party media disclosure risks that require clear safeguards.","remediation":[{"issue":"Generated prompts are embedded in shell-quoted JSON without a mandatory safe serialization procedure.","severity":"high","suggestion":"Build input with a JSON serializer and execute the CLI with an argument array. Never concatenate user-controlled text into a shell command."},{"issue":"The prerequisite installs an unversioned CLI package globally.","severity":"medium","suggestion":"Pin a reviewed CLI version and document package provenance and integrity verification before installation."},{"issue":"Prompts and media URLs are sent to RunComfy, and its servers fetch referenced media.","severity":"medium","suggestion":"Require user approval before transfer, warn against sensitive media, and recommend short-lived access-controlled URLs."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":29,"line_start":27},{"file":"SKILL.md","line_end":37,"line_start":29},{"file":"SKILL.md","line_end":49,"line_start":37},{"file":"SKILL.md","line_end":50,"line_start":49},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":58,"line_start":51},{"file":"SKILL.md","line_end":64,"line_start":58},{"file":"SKILL.md","line_end":65,"line_start":64},{"file":"SKILL.md","line_end":66,"line_start":65},{"file":"SKILL.md","line_end":67,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":69,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":85,"line_start":77},{"file":"SKILL.md","line_end":89,"line_start":85},{"file":"SKILL.md","line_end":98,"line_start":89},{"file":"SKILL.md","line_end":102,"line_start":98},{"file":"SKILL.md","line_end":104,"line_start":102},{"file":"SKILL.md","line_end":105,"line_start":104},{"file":"SKILL.md","line_end":112,"line_start":105},{"file":"SKILL.md","line_end":120,"line_start":112},{"file":"SKILL.md","line_end":121,"line_start":120},{"file":"SKILL.md","line_end":122,"line_start":121},{"file":"SKILL.md","line_end":123,"line_start":122},{"file":"SKILL.md","line_end":124,"line_start":123},{"file":"SKILL.md","line_end":124,"line_start":124},{"file":"SKILL.md","line_end":138,"line_start":128},{"file":"SKILL.md","line_end":143,"line_start":138},{"file":"SKILL.md","line_end":145,"line_start":143},{"file":"SKILL.md","line_end":145,"line_start":145},{"file":"SKILL.md","line_end":159,"line_start":151},{"file":"SKILL.md","line_end":160,"line_start":159},{"file":"SKILL.md","line_end":161,"line_start":160},{"file":"SKILL.md","line_end":161,"line_start":161},{"file":"SKILL.md","line_end":174,"line_start":167},{"file":"SKILL.md","line_end":178,"line_start":174},{"file":"SKILL.md","line_end":185,"line_start":178},{"file":"SKILL.md","line_end":190,"line_start":185},{"file":"SKILL.md","line_end":200,"line_start":190},{"file":"SKILL.md","line_end":217,"line_start":200},{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":221,"line_start":221},{"file":"SKILL.md","line_end":224,"line_start":222},{"file":"SKILL.md","line_end":224,"line_start":224}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":213,"line_start":213}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":133,"line_start":133},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":182,"line_start":182},{"file":"SKILL.md","line_end":221,"line_start":221},{"file":"SKILL.md","line_end":221,"line_start":221}]}],"critical_findings":[],"high_findings":[{"title":"Unsafe Shell Construction for Generated Prompts","locations":[{"file":"SKILL.md","line_end":84,"line_start":77},{"file":"SKILL.md","line_end":222,"line_start":222}],"confidence":0.86,"description":"The examples embed generated prompt text inside single-quoted JSON passed through a shell. The skill lacks a mandatory serialization rule for arbitrary user-controlled characters.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The command examples directly place prompt text inside shell-quoted JSON, while line 222 asserts safety after shell parsing. Robust argument construction is not required."}],"medium_findings":[{"title":"Unpinned Global CLI Installation","locations":[{"file":"SKILL.md","line_end":49,"line_start":49}],"confidence":0.97,"description":"The prerequisite installs the latest RunComfy CLI globally without a version pin. Package compromise or incompatible updates could execute code with user permissions.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Line 49 explicitly uses a global npm installation with no version. This is a clear dependency integrity and update risk."},{"title":"Third-Party Prompt and Media Disclosure","locations":[{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":224,"line_start":223}],"confidence":0.98,"description":"The CLI sends prompts to RunComfy and its servers fetch user-provided media URLs. Sensitive content may leave the user's controlled environment.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Lines 217 and 223 explicitly describe API submission and server-side retrieval of user media. The external data flow is documented and unambiguous."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":226,"audit_model":"codex","audited_at":"2026-07-24T01:40:57.456+00:00","created_at":"2026-07-24T04:03:33.577446+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"on the wrong model. Calls `runcomfy run <vendor>/<model>/<endpoint>`","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":29,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Replace packaging design using a reference image | **Wan 2.7 Edit-Video** + `reference_image` | Re","category":"external_commands","line_end":49,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **RunComfy CLI** — `npm i -g @runcomfy/cli`","category":"external_commands","line_end":50,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **RunComfy account** — `runcomfy login`.","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.","category":"external_commands","line_end":58,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `wan-ai/wan-2-7/edit-video`","category":"external_commands","line_end":64,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Lead with preservation. One edit direction per call. |","category":"external_commands","line_end":65,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video` | string | yes | — | MP4/MOV URL, 2–10s, ≤100MB. |","category":"external_commands","line_end":66,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `reference_image` | string | no | — | URL — use for direct design / appearance transfer only. |","category":"external_commands","line_end":67,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | (input) | `720p` or `1080p`. |","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `aspect_ratio` | enum | no | (input) | W:H. Defaults to input. |","category":"external_commands","line_end":69,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `duration` | int | no | 0 | `0` = match input; `2–10` = truncate from start. |","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `audio_setting` | enum | no | `auto` | `auto` or `origin` (preserve source audio). |","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `seed` | int | no | — | Reproducibility. |","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":98,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":102,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Preservation goals first**: `\"Preserve [face / pose / motion / framing / lip movement]; [then st","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`reference_image` only when justified** (packaging swap, costume swap with target visual). Don't","category":"external_commands","line_end":105,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`audio_setting: \"origin\"`** for talking-head where you don't want soundtrack regenerated.","category":"external_commands","line_end":112,"severity":"medium","line_start":105},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `kling/kling-2-6/motion-control-pro`","category":"external_commands","line_end":120,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | Describe target motion / style. |","category":"external_commands","line_end":121,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `image` | string | yes (image orientation) | Reference for character / background consistency. |","category":"external_commands","line_end":122,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video` | string | yes | **Motion reference**. 10–30s depending on orientation. |","category":"external_commands","line_end":123,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keep_original_sound` | bool | no | Preserve audio from reference video. |","category":"external_commands","line_end":124,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `character_orientation` | enum | yes | `image` (max 10s output) or `video` (max 30s output). |","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":138,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":143,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Spatial constraints help**: `\"character on left side, background motion right\"`.","category":"external_commands","line_end":145,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`character_orientation: \"image\"`** caps output at 10s; `\"video\"` allows 30s.","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Model**: `decart/lucy-edit/restyle`","category":"external_commands","line_end":159,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `prompt` | string | yes | — | Natural-language edit instruction. |","category":"external_commands","line_end":160,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `video_url` | string | yes | — | MP4/MOV/WEBM/GIF. |","category":"external_commands","line_end":161,"severity":"medium","line_start":160},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `resolution` | enum | no | `720p` | `720p` only on this tier. |","category":"external_commands","line_end":161,"severity":"medium","line_start":161},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":174,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":178,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":185,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Preserve identity goals** — `\"preserve face and motion\"` is enough; don't over-specify.","category":"external_commands","line_end":200,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Brand-specific overrides** — if the user named a specific model, route to the corresponding bran","category":"external_commands","line_end":217,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The skill picks one of Wan 2.7 Edit-Video / Kling 2.6 Pro Motion Control / Lucy Edit Restyle based o","category":"external_commands","line_end":217,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"external_commands","line_end":221,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI d","category":"external_commands","line_end":224,"severity":"medium","line_start":222},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / ","category":"external_commands","line_end":224,"severity":"medium","line_start":224},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://www.runcomfy.com","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:SKILL.md:23:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=video-ed","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:SKILL.md:81:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../speaker.mp4\",","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"network:SKILL.md:93:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../hand-holding-package.mp4\",","category":"network","line_end":93,"severity":"low","line_start":93},{"id":"network:SKILL.md:94:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"reference_image\": \"https://.../new-packaging.png\",","category":"network","line_end":94,"severity":"low","line_start":94},{"id":"network:SKILL.md:132:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"image\": \"https://.../target-character.jpg\",","category":"network","line_end":132,"severity":"low","line_start":132},{"id":"network:SKILL.md:133:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video\": \"https://.../motion-reference-dance.mp4\",","category":"network","line_end":133,"severity":"low","line_start":133},{"id":"network:SKILL.md:171:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://.../subject-walking.mp4\"","category":"network","line_end":171,"severity":"low","line_start":171},{"id":"network:SKILL.md:182:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"video_url\": \"https://.../subject-portrait.mp4\"","category":"network","line_end":182,"severity":"low","line_start":182},{"id":"network:SKILL.md:213:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"Full reference: [docs.runcomfy.com/cli/troubleshooting](https://docs.runcomfy.com/cli/troubleshootin","category":"network","line_end":213,"severity":"low","line_start":213},{"id":"filesystem:SKILL.md:81:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../speaker.mp4\",","category":"filesystem","line_end":81,"severity":"high","line_start":81},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../hand-holding-package.mp4\",","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"reference_image\": \"https://.../new-packaging.png\",","category":"filesystem","line_end":94,"severity":"high","line_start":94},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"image\": \"https://.../target-character.jpg\",","category":"filesystem","line_end":132,"severity":"high","line_start":132},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video\": \"https://.../motion-reference-dance.mp4\",","category":"filesystem","line_end":133,"severity":"high","line_start":133},{"id":"filesystem:SKILL.md:171:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video_url\": \"https://.../subject-walking.mp4\"","category":"filesystem","line_end":171,"severity":"high","line_start":171},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"\"video_url\": \"https://.../subject-portrait.mp4\"","category":"filesystem","line_end":182,"severity":"high","line_start":182},{"id":"filesystem:SKILL.md:221:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":221,"severity":"high","line_start":221},{"id":"filesystem:SKILL.md:221:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m","category":"filesystem","line_end":221,"severity":"medium","line_start":221},{"id":"blocker:SKILL.md:191:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid total replacement** (\"astronaut in space\" works; \"swap subject for a different person\" doe","category":"blocker","line_end":191,"severity":"low","line_start":191}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"Line 13 uses Markdown inline code to name a CLI command. It contains no shell backtick substitution or executable Ruby.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Lines 27-29 are a Markdown bash fence around a fixed installation command. The backticks delimit documentation and are not shell execution syntax.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 is the closing delimiter of a Markdown code block. It cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Line 37 formats a parameter name as inline code in a model-routing table. No command is evaluated.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Line 49 documents a prerequisite command with Markdown backticks. It does not use backticks for command substitution.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Line 50 displays a fixed login command as inline code. The text itself does not execute the command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 formats an environment variable assignment as documentation. No shell backtick execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Line 58 formats a RunComfy model identifier in Markdown. It is data, not an executable expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Line 64 formats a schema field name in Markdown. No command execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Line 65 formats a video field name in a documentation table. It is not shell syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"Line 66 formats a reference image field name. The backticks are Markdown delimiters only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"Line 67 displays allowed resolution values as inline code. It performs no execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Line 68 formats an aspect ratio field in a schema table. It is documentation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"Line 69 formats duration values in a schema table. No shell or Ruby evaluation exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"Line 70 displays audio option names using Markdown inline code. It cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"Line 71 formats a seed field name. The backticks are not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"Lines 77-85 are a Markdown bash example, so the detected backticks are fence markers. Dynamic input safety is assessed separately.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"Line 85 closes a Markdown code fence. It is not a shell backtick expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Lines 89-98 are a documented RunComfy example inside a Markdown fence. The fence backticks do not execute the example.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Line 98 is a closing Markdown fence and has no executable semantics.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Line 102 formats an example natural-language prompt. It is not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"Line 104 formats a parameter name as inline code. No backtick command substitution is used.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:105:ruby-shell-backtick-execution","reason":"Line 105 displays a JSON option in Markdown. It is documentation rather than execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"Line 112 formats a model identifier. The text is not executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"Line 120 formats a prompt field name in a schema table. No command syntax is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"Line 121 formats an image field name. It does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"Line 122 formats a video field name in documentation. It is not executable.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"Line 123 formats a Boolean field name. The backticks have only Markdown meaning.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"Line 124 displays orientation option names as inline code. No command executes.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"Lines 128-138 are a fenced shell example with fixed argument structure. Markdown fence markers are not shell backtick execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"Line 138 closes a Markdown code block and cannot execute anything.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"Line 143 formats a natural-language spatial prompt. It is not a command expression.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Line 145 formats a schema field and values. The backticks are Markdown only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"Line 151 displays a model identifier as inline code. It is not executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"Line 159 formats a prompt field in a documentation table. No shell execution occurs.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:160:ruby-shell-backtick-execution","reason":"Line 160 formats a video URL field name. It is not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:161:ruby-shell-backtick-execution","reason":"Line 161 displays a resolution value with Markdown backticks. It cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"Lines 167-174 are a documented CLI example inside a Markdown fence. The detected backticks are formatting delimiters.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"Line 174 is a closing Markdown fence without executable behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"Lines 178-185 are a fenced RunComfy example. The backticks mark documentation and do not perform command substitution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"Line 185 only closes a Markdown code block. It does not execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"Line 190 formats a natural-language preservation phrase. It is neither Ruby nor shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"Line 200 formats another skill name as inline code. No command is invoked.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"Line 217 uses Markdown code spans to describe CLI behavior and domains. It contains no backtick command substitution.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"Line 221 formats a login command, token path, and environment variable as documentation. The backticks do not execute them.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:222:ruby-shell-backtick-execution","reason":"Line 222 formats a CLI option name in Markdown. The separate safety of shell-quoted dynamic input is assessed semantically.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Line 224 formats allowed hostnames as inline code. Hostname text is not an executable command.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:17:hardcoded-url","reason":"Line 17 is homepage metadata. It does not initiate a network request or transmit data.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:23:hardcoded-url","reason":"Line 23 contains visible RunComfy and GitHub navigation links. These are documentation links, not covert network calls.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:81:hardcoded-url","reason":"Line 81 uses an ellipsis URL as a video placeholder in an example. It is not a valid hardcoded endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:93:hardcoded-url","reason":"Line 93 contains an illustrative media URL with an ellipsis. It does not identify a real remote destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:94:hardcoded-url","reason":"Line 94 contains a placeholder reference-image URL. No actual host is hardcoded.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:132:hardcoded-url","reason":"Line 132 uses an ellipsis URL to show where a user image belongs. It is not a reachable endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:133:hardcoded-url","reason":"Line 133 is a placeholder for a user-provided motion video URL. It does not hardcode a service.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:171:hardcoded-url","reason":"Line 171 contains an illustrative source-video URL with no real hostname. It cannot initiate a request.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:182:hardcoded-url","reason":"Line 182 contains an ellipsis URL placeholder for user media. It is not a hardcoded network target.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:213:hardcoded-url","reason":"Line 213 is a visible link to RunComfy troubleshooting documentation. It performs no automatic network activity.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:81:path-traversal-sequence","reason":"The three dots on line 81 occur inside an HTTPS URL placeholder. They are not a parent-directory sequence or filesystem path.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:93:path-traversal-sequence","reason":"The ellipsis on line 93 abbreviates a sample URL. No filesystem traversal is requested.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:94:path-traversal-sequence","reason":"Line 94 contains an abbreviated HTTPS placeholder, not a relative filesystem path.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:132:path-traversal-sequence","reason":"Line 132 uses three dots within a sample URL. This cannot traverse local directories.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:133:path-traversal-sequence","reason":"The detected sequence on line 133 belongs to an illustrative HTTPS URL. It is unrelated to filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:171:path-traversal-sequence","reason":"Line 171 contains an ellipsis in a remote media placeholder. It is not a directory traversal sequence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:182:path-traversal-sequence","reason":"Line 182 shows an abbreviated URL for example media. No local path manipulation occurs.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:221:hidden-file-in-home-directory","reason":"Line 221 documents where the external CLI stores its token and specifies owner-only mode 0600. The skill does not access that file.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:221:hidden-file-access","reason":"The home-directory path on line 221 is a disclosure of expected CLI behavior. There is no instruction to read or modify the hidden file directly.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:191:system-reconnaissance","reason":"Line 191 discusses replacing a person in generated video. It contains no host, account, network, or environment reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Unsafe Shell Construction for Generated Prompts","severity":"high","locations":[{"file":"SKILL.md","line_end":84,"line_start":77},{"file":"SKILL.md","line_end":222,"line_start":222}],"confidence":0.86,"description":"The examples embed generated prompt text inside single-quoted JSON passed through a shell. The skill lacks a mandatory serialization rule for arbitrary user-controlled characters.","confidence_reasoning":"The command examples directly place prompt text inside shell-quoted JSON, while line 222 asserts safety after shell parsing. Robust argument construction is not required."},{"title":"Unpinned Global CLI Installation","severity":"medium","locations":[{"file":"SKILL.md","line_end":49,"line_start":49}],"confidence":0.97,"description":"The prerequisite installs the latest RunComfy CLI globally without a version pin. Package compromise or incompatible updates could execute code with user permissions.","confidence_reasoning":"Line 49 explicitly uses a global npm installation with no version. This is a clear dependency integrity and update risk."},{"title":"Third-Party Prompt and Media Disclosure","severity":"medium","locations":[{"file":"SKILL.md","line_end":217,"line_start":217},{"file":"SKILL.md","line_end":224,"line_start":223}],"confidence":0.98,"description":"The CLI sends prompts to RunComfy and its servers fetch user-provided media URLs. Sensitive content may leave the user's controlled environment.","confidence_reasoning":"Lines 217 and 223 explicitly describe API submission and server-side retrieval of user media. The external data flow is documented and unambiguous."}],"subject_marketplace_commit_sha":"9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2","subject_content_hash":"e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44","subject_tree_hash":"fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1","subject_plugin_path":"skills/skills-collective/video-edit","audit_payload_hash":"672b73e714b0441b8bc085e5d4927d59","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2","contentHash":"e7886a19ebdd2558e4a2965a779ca72e2a867fdbf7ec89de11288cd94d45aa44","treeHash":"fc2dc31b1adc54fbb4d78f93dde1d703c23f65ad04131a5b037ec9c53cef00f1","pluginPath":"skills/skills-collective/video-edit","auditPayloadHash":"672b73e714b0441b8bc085e5d4927d59"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/skills-collective-video-edit/audits/4/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}