This report does not block or authorize the manifest or ZIP.
Static analysis reported many command, network, filesystem, and weak-crypto patterns, but most high-severity matches are Markdown or placeholder false positives. The real risks are intended behavior: invoking the local RunComfy CLI, sending prompts and media URLs to RunComfy over HTTPS, downloading generated outputs, and storing or reading an API token. No prompt injection attempt, hidden exfiltration flow, or confirmed malicious intent was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 186 Lines analyzed
3 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
The skill instructs the agent to run the local RunComfy CLI for Wan 2.7 video generation. This is the intended function, but it executes an external command and submits user prompts to a remote model service.
The command and remote POST behavior are explicitly documented. The risk is real but appears purposeful for a RunComfy video-generation skill, not hidden or malicious.
The skill documents login and CI token handling, including token storage under the user config directory. Token handling is expected for authenticated API access, but mishandling could expose credentials.
The file clearly documents token storage and RUNCOMFY_TOKEN usage. It also states owner-only permissions, which lowers severity but does not remove credential-handling risk.
Outbound Media URLs and Generated Output Downloads
The skill supports audio URLs and describes downloading generated output from RunComfy domains. This can expose supplied media URLs and creates filesystem writes in the selected output directory.
The network and download behavior is documented in the security section. The stated endpoint whitelist and file size cap reduce but do not eliminate data exposure and filesystem-write concerns.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
No confirmed security findings were recorded for this completed audit.
04
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Markdown Backtick Command Detections Are Mostly False Positives
Many static external-command detections are Markdown inline code or fenced examples for documented CLI usage and input fields. They do not show hidden dynamic shell construction or user-controlled shell expansion.
The flagged ranges are documentation tables and prose, not executable source code. The security section states the prompt is passed as JSON and is not shell-expanded.
Weak Crypto and Path Traversal Findings Are False Positives
The weak cryptography matches occur in ordinary Markdown text such as frontmatter, anti-pattern wording, and an exit-code heading. The path traversal match is an ellipsis placeholder in an example URL, not filesystem traversal.
No cryptographic API or path manipulation code is present in the reviewed file. These findings are caused by broad string matching against Markdown content.