Versioned security assessment

Report ID: SA-1ABEAD63

7/8/2026, 12:37:15 AM

seedance-v2 security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
seedance-v2
Version
v4
Maintainer
agentspace-so
Source
github.com/agentspace-so/runcomfy-agent-skills/tree/main/seedance-v2/
Coverage
1 Files scanned · 182 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static detections are Markdown formatting false positives, including placeholder URLs and code-fence markers. Confirmed risks are the intended RunComfy CLI workflow, outbound RunComfy API submission, global CLI installation guidance, and disclosed token storage in a hidden config file. No prompt injection or deceptive override language was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 182 Lines analyzed

15 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (14)
High
SKILL.md:177
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents token storage at ~/.config/runcomfy/token.json. The storage is disclosed and permission-restricted, but it is real hidden-file credential handling.
Medium
SKILL.md:10
Ruby/shell backtick execution
Calls `runcomfy run bytedance/seedance-v2/pro` through the local
The line documents use of the runcomfy CLI as part of the skill workflow. This is an intended external command path rather than hidden execution.
Medium
SKILL.md:24-26
Ruby/shell backtick execution
```bash
The fenced example includes an npx command that installs a community skill globally. This is explicit external command execution and can modify the local tool environment.
Medium
SKILL.md:46-47
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Global package installation is an external command with supply-chain and local environment impact.
Medium
SKILL.md:47-48
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The skill instructs authentication through the RunComfy CLI and discusses token use. This is legitimate setup, but it involves external command execution and credential handling.
Medium
SKILL.md:48
Ruby/shell backtick execution
3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.
The skill instructs authentication through the RunComfy CLI and discusses token use. This is legitimate setup, but it involves external command execution and credential handling.
Medium
SKILL.md:70-74
Ruby/shell backtick execution
```bash
The code block shows the agent or user running runcomfy with user-controlled prompt and media inputs. The command is intended, but it executes a local CLI and writes generated output.
Medium
SKILL.md:78-87
Ruby/shell backtick execution
```bash
The code block shows the agent or user running runcomfy with user-controlled prompt and media inputs. The command is intended, but it executes a local CLI and writes generated output.
Medium
SKILL.md:91-100
Ruby/shell backtick execution
```bash
The code block shows the agent or user running runcomfy with user-controlled prompt and media inputs. The command is intended, but it executes a local CLI and writes generated output.
Medium
SKILL.md:102
Ruby/shell backtick execution
The CLI submits, polls, fetches the result, downloads `*.runcomfy.net`/`*.runcomfy.com` URLs into `-
The text describes the CLI submitting, polling, fetching, and downloading results into an output directory. These are real side effects from the external command workflow.
Medium
SKILL.md:173
Ruby/shell backtick execution
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The
The skill explicitly states that it invokes the runcomfy CLI and posts requests to the model API. This confirms intentional external command execution with network side effects.
Medium
SKILL.md:177
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill instructs authentication through the RunComfy CLI and discusses token use. This is legitimate setup, but it involves external command execution and credential handling.
Medium
SKILL.md:177
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents token storage at ~/.config/runcomfy/token.json. The storage is disclosed and permission-restricted, but it is real hidden-file credential handling.
Low
SKILL.md:173
Hardcoded URL
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The
The line documents an outbound POST to the RunComfy model API and downloads from RunComfy domains. The network access is intentional and disclosed, not covert.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:173SKILL.md:179
User Content Sent to Third-Party Model API
The skill states that prompts are POSTed to RunComfy and that referenced media URLs are fetched by the RunComfy model server. This creates a disclosed third-party data exposure risk for prompts and media references.
The source explicitly describes the model API POST and remote fetching of reference media. No evidence indicates covert exfiltration, so the finding is limited to disclosed privacy exposure.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    API token stored in a hidden home directory file
    Prefer RUNCOMFY_TOKEN for CI, document token revocation, and never read, print, or transmit the token outside RunComfy authentication.
  2. FIX-002
    Medium
    External CLI execution and network submission
    Require user confirmation before running RunComfy commands, and show the endpoint, prompt summary, reference URLs, and output directory first.
  3. FIX-003
    Medium
    Global CLI installation guidance
    Pin or recommend a verified @runcomfy/cli version, and avoid automated global installs without explicit user approval.
  4. FIX-004
    Medium
    Third-party processing of prompts and media references
    Warn users not to submit confidential prompts or private media URLs unless their RunComfy data handling policy permits it.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable