Audit History

The skill has expected external-command and network behavior because it runs the RunComfy CLI to submit video jobs. Most static hits are false positives from Markdown backticks and ellipsis in documentation, but CLI execution and bearer-token API submission remain confirmed risks. No evidence found of prompt injection text in the skill file.

The skill has expected external-command and network behavior because it runs the RunComfy CLI to submit video jobs. Most static hits are false positives from Markdown backticks and ellipsis in documentation, but CLI execution and bearer-token API submission remain confirmed risks. No evidence found of prompt injection text in the skill file.

The skill primarily documents a legitimate RunComfy text-to-video workflow, including expected CLI commands and outbound RunComfy API access. Most static hits are Markdown backticks, code fences, URL documentation, or ellipses in API paths rather than malicious behavior. The remaining confirmed issues are the intended external CLI and third-party network dependency, so users should install and run it only when they trust RunComfy and understand credential handling.

The skill intentionally uses the RunComfy CLI to submit text-to-video jobs and download generated outputs. Most static findings are Markdown formatting, examples, URLs, or documented service behavior rather than hidden execution, path traversal, or reconnaissance. The remaining confirmed issues are disclosed external command and network dependencies that users should understand before installing.

The real risks are the intended RunComfy CLI executions, global setup commands, and the disclosed POST to the RunComfy Model API. Most other static findings are Markdown backtick, REST ellipsis, documentation link, or standard credential-store false positives.

Most static backtick hits are Markdown examples, prompt samples, or inline parameter names, not Ruby execution. The meaningful risks are the intended RunComfy CLI execution, third-party API calls with a bearer token, output downloads, and disclosed token setup.

Most static backtick hits are Markdown examples, prompt samples, or inline parameter names, not Ruby execution. The meaningful risks are the intended RunComfy CLI execution, third-party API calls with a bearer token, output downloads, and disclosed token setup.

Static findings for Ruby backtick execution and weak cryptography are false positives caused by Markdown code spans, examples, arrows, and prose in SKILL.md. The confirmed risks are intentional RunComfy CLI execution, outbound HTTPS API calls, bearer token handling, and downloaded output files, so users should publish with a clear external-service warning.

Static analysis flagged 86 potential issues, but evaluation reveals most are false positives. The skill is a legitimate RunComfy CLI wrapper for video generation. Backtick detections are markdown code formatting, not Ruby execution. Network calls go to documented RunComfy API endpoints. Filesystem access is limited to output directory. Security documentation is present and comprehensive.