Versioned security assessment

Report ID: SA-80DD0E2C

7/5/2026, 2:37:26 AM

happyhorse-1-0 security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
happyhorse-1-0
Version
v4
Maintainer
agentspace-so
Source
github.com/agentspace-so/runcomfy-agent-skills/tree/main/happyhorse-1-0/
Coverage
1 Files scanned · 196 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static backtick hits are Markdown examples, prompt samples, or inline parameter names, not Ruby execution. The meaningful risks are the intended RunComfy CLI execution, third-party API calls with a bearer token, output downloads, and disclosed token setup.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 196 Lines analyzed

15 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 4 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 40 evidence locations

Capability review items (15)
Medium
SKILL.md:10
Ruby/shell backtick execution
Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through
The description states that the skill calls the local runcomfy CLI. This is intended behavior, but it is real external command execution with network and filesystem effects.
Medium
SKILL.md:24-26
Ruby/shell backtick execution
```bash
The fenced block contains an npx skills add installation command. It is documentation, but it asks the user or agent to run a remote package command.
Medium
SKILL.md:44-45
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite instructs installing @runcomfy/cli globally with npm. Global package installation is an external command and has supply-chain risk.
Medium
SKILL.md:45-46
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The prerequisite instructs running runcomfy login. That launches an authentication flow and prepares credentials for later CLI calls.
Medium
SKILL.md:65-69
Ruby/shell backtick execution
```bash
The fenced block shows runcomfy run with user prompt input and an output directory. It is a real external CLI invocation, although arguments are structured JSON.
Medium
SKILL.md:73-82
Ruby/shell backtick execution
```bash
The fenced block shows a runcomfy run invocation for a vertical short. It executes a local CLI and passes user-controlled prompt text as JSON.
Medium
SKILL.md:86-90
Ruby/shell backtick execution
```bash
The fenced block shows another runcomfy run invocation. It is intended external command execution with model API and download side effects.
Medium
SKILL.md:92
Ruby/shell backtick execution
The CLI submits, polls every 2s until terminal, then downloads any `*.runcomfy.net` / `*.runcomfy.co
The line describes the CLI polling and downloading generated URLs into an output directory. This confirms the external command has network and filesystem effects.
Medium
SKILL.md:178-179
Ruby/shell backtick execution
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matchin
The how-it-works section says the skill invokes runcomfy run with a JSON body. This confirms intended local external command execution.
Medium
SKILL.md:179-180
Ruby/shell backtick execution
2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide
The CLI POSTs to the RunComfy model API with the user bearer token. This is expected, but it is network activity initiated by the external command.
Medium
SKILL.md:180
Ruby/shell backtick execution
3. The Model API returns a `request_id`; the CLI polls `GET .../requests/<id>/status` every 2 second
The CLI polls a remote request status endpoint every two seconds. This is part of the documented external command behavior.
Medium
SKILL.md:181
Ruby/shell backtick execution
4. On terminal status, the CLI fetches `GET .../requests/<id>/result` and downloads any URL whose ho
The CLI fetches the result and downloads whitelisted generated output URLs into the chosen output directory. This combines external network access with local file writes.
Medium
SKILL.md:182
Ruby/shell backtick execution
5. `Ctrl-C` while polling sends `POST .../requests/<id>/cancel` so you don't get billed for GPU you
The line documents a cancellation POST sent by the CLI when interrupted. It is a minor but real remote side effect of the command.
Medium
SKILL.md:191
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The line states runcomfy login writes an API token for later CLI use. Credential setup is part of the external command workflow and should be treated carefully.
Low
SKILL.md:179
Hardcoded URL
2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide
The CLI submits requests to the RunComfy model API with the user bearer token. This is disclosed and expected, but it is real third-party network transfer.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    External CLI execution
    Require user confirmation before running runcomfy commands, and show the exact inputs, endpoint, and output directory.
  2. FIX-002
    Medium
    Global CLI installation
    Pin the RunComfy CLI version in installation instructions, and prefer documented package integrity checks when available.
  3. FIX-003
    Medium
    Credential handling
    Keep token file permissions at 0600, document token rotation, and prefer RUNCOMFY_TOKEN for CI environments.
  4. FIX-004
    Medium
    Generated output downloads
    Keep the download host whitelist and file size cap, and write only to a user-approved output directory.
  5. FIX-005
    Low
    Third-party model API transfer
    Tell users that prompts and generated assets are sent to RunComfy, and advise against submitting sensitive content.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable