All 52 static findings are false positives caused by Markdown formatting, expected documentation links, a documented credential path, and unrelated phrase matches. However, the documented command embeds user-controlled URL and prompt values in single-quoted JSON without a shell-safe construction method, creating a plausible command-injection path. The workflow also transfers user media to RunComfy for external processing.
The documented invocation embeds the video URL and prompt in a single-quoted shell argument. An apostrophe in either value can terminate the argument and introduce additional shell syntax unless the agent applies escaping that the skill does not define.
Lines 71-77 show the values inside single shell quotes, while line 141 claims safety without documenting shell-level escaping. Exploitation depends on how the agent substitutes user values.
The CLI sends the source video URL and continuation prompt to the RunComfy Model API, then downloads the generated clip. Sensitive media or signed URLs may be disclosed to an external processor.
Line 135 explicitly states that the CLI posts the video URL and prompt to the RunComfy Model API and polls for the result.
I reviewed SKILL.md in context and found no malicious intent. The external-command detections are Markdown formatting or documented runcomfy CLI examples, the network detections are documentation or user-provided media URLs, and the hidden-file detections describe normal CLI token storage.
No malicious intent or prompt injection attempt was found in SKILL.md. The static findings are false positives from Markdown code spans, public RunComfy links, documented CLI usage, and disclosed token storage.
Static analysis flagged many command, URL, filesystem, weak crypto, and reconnaissance patterns. Review found no evidence of malicious intent or prompt injection, but the skill legitimately invokes an external CLI, sends user media prompts to RunComfy, and documents local token storage.
1
Files scanned
156
Lines analyzed
6
Review items
3
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
TRUE POSITIVE. The skill instructs agents to run the RunComfy CLI. This is expected for the skill, but it executes an external tool and should stay limited to runcomfy commands.
The command examples and security notes directly document runcomfy execution. The allowed tool boundary narrows the risk, so this is medium rather than high.
TRUE POSITIVE. The workflow sends a source video URL and continuation prompt to RunComfy. This is core functionality, but users must understand the privacy boundary.
The file states that the CLI posts to the RunComfy Model API and references RunComfy network endpoints. No evidence shows unauthorized exfiltration.
TRUE POSITIVE with mitigation. The skill documents that login stores a token in a hidden config path. It also says the token uses mode 0600 and should not be logged.
The storage path and permissions are explicitly documented. This is sensitive credential handling, but the stated permissions reduce practical risk.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Hardcoded URLs are documentation and allowlisted endpoints
FALSE POSITIVE for malicious networking. The URLs point to RunComfy pages, skills documentation, example input, and stated allowlisted RunComfy endpoints.
The URLs are readable Markdown links or expected service endpoints. I found no encoded destinations, webhook URLs, or unrelated domains.
Markdown backticks misclassified as Ruby shell execution
FALSE POSITIVE for Ruby backtick execution. The repeated static hits are Markdown inline code spans and fenced shell examples, not executable Ruby source code.
The only file is Markdown and the backticks format commands or endpoint names. No Ruby file or Ruby execution context exists.
All 78 static analysis findings are FALSE POSITIVES. The static analyzer misinterpreted Markdown backtick formatting (inline code) as Ruby shell backtick execution in this Markdown documentation file. All URL references are legitimate documentation links to RunComfy service, model catalog, and related skills. The single filesystem reference documents token storage for user awareness. The skill is a legitimate video extension tool that uses the runcomfy CLI and Google Veo 3-1 models. No malicious intent, prompt injection attempts, or obfuscated behavior detected. Skill uses external commands, network access, and filesystem access as documented and expected for this type of tool.
Usage guidance misidentified as system reconnaissance
Lines 53 and 58 contain usage guidance comparing the standard Veo 3-1 Extend and Fast Extend model tiers. These advise when to use each endpoint for cost control, not reconnaissance.
The lines discuss model endpoint selection based on quality vs cost trade-offs. No system commands, environment queries, or diagnostic operations are present.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Documentation URLs flagged as hardcoded network endpoints
24 URL references were flagged as hardcoded network endpoints. These are legitimate documentation links to the RunComfy homepage, model catalog, API documentation, and related skill pages. They serve as user reference material, not executable network requests.
All URLs point to runcomfy.com, skills.sh, or docs.runcomfy.com domains which are the legitimate service provider and documentation sites. UTM parameters confirm marketing attribution, not malicious tracking.
Token storage documentation flagged as filesystem access
Line 140 references ~/.config/runcomfy/token.json in the Security & Privacy section to document where the runcomfy login command stores authentication tokens. This is transparency documentation, not actual file system access code.
The reference appears in a dedicated Security & Privacy section that explains token storage to the user. The skill accesses RUNCOMFY_TOKEN env var, but documents the credential file path for user awareness.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown backticks misidentified as shell execution
The static analyzer flagged 44 instances of backtick characters in SKILL.md as Ruby shell backtick execution. The file is a Markdown document where backticks are used for inline code formatting (e.g., `runcomfy`, `extend-video`). These are not code execution constructs.
Backticks in a .md file are Markdown formatting, not Ruby code. The file has no Ruby code, no .rb extension, and no require/inherit Ruby constructs.
Lines flagged for weak crypto (lines 5, 9, 82, 120) contain only YAML frontmatter license field and plain English text about prompting tips and exit codes. No cryptographic algorithms exist in the file.
No base64-encoded strings, cipher references, or cryptographic function calls exist in the SKILL.md file. The analyzer appears to have false-triggered on unrelated content.