Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 8:08:06 AM

seedance-v2 security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
seedance-v2
Version
v8
Maintainer
agentspace-so
Source
github.com/agentspace-so/runcomfy-agent-skills/tree/main/seedance-v2/
Coverage
1 Files scanned · 182 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static command findings are Markdown formatting or schema terms, but the skill intentionally runs RunComfy CLI commands and uses RunComfy network services. Placeholder media URLs are false positives for path traversal. The main residual risks are third-party prompt and media submission, local CLI execution, and token storage.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 182 Lines analyzed

14 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 37 evidence locations

Capability review items (12)
High
SKILL.md:177
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents API token storage at ~/.config/runcomfy/token.json. This places a service credential on disk in the user home directory, even with owner-only permissions.
Medium
SKILL.md:10
Ruby/shell backtick execution
Calls `runcomfy run bytedance/seedance-v2/pro` through the local
The description says the skill calls the RunComfy CLI locally. That is intended external command execution against a third-party video service.
Medium
SKILL.md:24-26
Ruby/shell backtick execution
```bash
The fenced bash block includes an npx skills add command. It is documentation, but it still instructs execution of an external installer command.
Medium
SKILL.md:46-47
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to run npm i -g @runcomfy/cli. Installing and running a global npm CLI is a real external command risk.
Medium
SKILL.md:47-48
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The skill instructs runcomfy login, which invokes a local CLI and opens an authentication flow. This is benign but still external command execution.
Medium
SKILL.md:70-74
Ruby/shell backtick execution
```bash
The bash example runs runcomfy run with user prompt data and an output directory. This is a clear local external command invocation.
Medium
SKILL.md:78-87
Ruby/shell backtick execution
```bash
The bash example runs runcomfy run with prompt and image reference input. This invokes a local CLI and sends data outside the workspace.
Medium
SKILL.md:91-100
Ruby/shell backtick execution
```bash
The bash example runs runcomfy run with image, video, and audio references. This is intended external command execution with user-provided media URLs.
Medium
SKILL.md:173
Ruby/shell backtick execution
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The
The How it works section states the skill invokes runcomfy run and posts to the model API. The command and network behavior are intentional.
Medium
SKILL.md:177
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The security section references runcomfy login as the token setup command. It is legitimate, but it is still a local CLI action tied to credential handling.
Medium
SKILL.md:173
Hardcoded URL
The skill invokes `runcomfy run bytedance/seedance-v2/pro` with a JSON body matching the schema. The
The skill explicitly sends requests to model-api.runcomfy.net and downloads outputs from RunComfy domains. This is intended outbound network access to a third-party service.
Medium
SKILL.md:177
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The documented RunComfy login flow writes a token into a hidden config path. This is legitimate CLI behavior, but it remains sensitive local filesystem access.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:173SKILL.md:179
Third-Party Prompt and Media Disclosure
The skill sends prompts and reference media URLs to RunComfy model infrastructure. Sensitive prompts or private media could leave the local environment.
Line 173 describes posting to the model API, and line 179 states third-party media URLs are fetched by the model server.
RISK-002 Medium
SKILL.md:179
Untrusted Reference Media Prompt Injection Risk
The skill warns that image-based prompt injection is a known risk for image and video models. User-provided media could influence generation behavior.
The source explicitly names image-based prompt injection risk for external reference media, so the semantic risk is directly supported.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    RunComfy token storage
    Recommend scoped tokens, token rotation, and RUNCOMFY_TOKEN for CI. Document how users can remove the local token file.
  2. FIX-002
    Medium
    External CLI execution
    Require user confirmation before running RunComfy commands, and document the expected command, input file, and output directory.
  3. FIX-003
    Medium
    Third-party data transfer
    Warn users that prompts and media URLs are sent to RunComfy services, and advise against sensitive or unapproved media.
  4. FIX-004
    Low
    Ambiguous placeholder URLs
    Use example.com placeholder media URLs to avoid path traversal false positives from https://... examples.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Content hash
7ebf59acc65cfe3123b0f474efd8dd2f682358c78a716e9a09ff01f73e2e3380
Tree hash
f7996ce5e84b8602f701f60259983e9b9b7ac02fb99ee95a3fde3fff3d55eb05
Skill path
skills/agentspace-so/seedance-v2
Audit payload hash
acc2919fd51a91099e1b9fab4026a142

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable