Skills wan-2-7
๐Ÿ“ฆ

wan-2-7

Content revision r1 Medium Risk โš™๏ธ External commands๐ŸŒ Network access๐Ÿ“ Filesystem access

Generate Wan 2.7 Videos on RunComfy

Short video generation needs precise model inputs and clear output controls. This skill helps Claude, Codex, and Claude Code prepare Wan 2.7 requests through the RunComfy CLI.

Supports: Claude Codex Code(CC)
โš ๏ธ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "wan-2-7" from https://skillstore.io/skills/agentspace-so-wan-2-7.md and its manifest at https://skillstore.io/api/skills/agentspace-so-wan-2-7/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "wan-2-7". A creator asks for a five second product video in landscape format.

Expected outcome:

The skill produces a RunComfy generation plan with Wan 2.7 selected, 1080p resolution, 16:9 framing, a single product action, and a named output folder.

Using "wan-2-7". A producer provides a voiceover URL and asks for a vertical spokesperson clip.

Expected outcome:

The skill maps the audio URL to lip-sync generation, sets vertical framing, matches duration, and recommends a close-up prompt with stable lighting.

Using "wan-2-7". A team wants brand-strict wording without automatic prompt changes.

Expected outcome:

The skill recommends disabling prompt expansion, using a precise negative prompt, and reusing a seed for controlled comparisons.

Security Audit

Medium Risk
v8 โ€ข 7/9/2026 Open versioned report

Most static backtick findings are Markdown formatting false positives, but the skill does document real RunComfy CLI execution and a hosted API workflow. I confirmed the external command and outbound network risks, found no prompt injection attempt, and found no malicious hidden-file behavior.

1
Files scanned
186
Lines analyzed
10
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
Third-Party Prompt and Media Transfer
The skill sends the prompt body to RunComfy hosted Model API and says external media URLs are fetched by RunComfy model servers. Users could expose confidential prompts, audio, or private media URLs to a third party.
The workflow explicitly describes posting requests to RunComfy and server-side fetching of supplied URLs. This is clear privacy and data-handling risk, although it is documented and expected.
Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through
The skill states it calls the local RunComfy CLI for Wan 2.7 video generation. That is real external command execution and sends work to a hosted service.
Medium
Ruby/shell backtick execution
```bash
The fenced snippet runs npx to install a skill globally from a GitHub source. Global package or skill installation is external command execution with supply-chain impact.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** โ€” `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Installing global packages can execute package lifecycle code and modifies the host environment.
Medium
Ruby/shell backtick execution
2. **RunComfy account** โ€” `runcomfy login` opens a browser device-code flow.
The prerequisite tells users to run the RunComfy login command, which launches an authentication flow and changes local credential state. It is legitimate but still external command execution.
Medium
Ruby/shell backtick execution
```bash
The default invocation runs the RunComfy CLI with user prompt input and an output directory. This is intended behavior, but it is real local command execution.
Medium
Ruby/shell backtick execution
```bash
The audio-driven example runs the RunComfy CLI with prompt and audio URL inputs. It is intended behavior, but it combines local command execution with remote media processing.
Medium
Ruby/shell backtick execution
```bash
The literal-control example runs the RunComfy CLI and passes user-controlled generation settings. This is real external command execution even though the command is documented.
Medium
Ruby/shell backtick execution
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The prose confirms the skill invokes the RunComfy CLI, posts to the model API, polls the request, and downloads results. That confirms the external command and network workflow.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The line confirms the login command writes an API token to a local config path. It documents a credential-changing command, so the external command usage is security-sensitive.
Medium
Hardcoded URL
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The line identifies the concrete RunComfy model API endpoint and output download domains. This is intended behavior, but it is real outbound network traffic.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/agentspace-so-wan-2-7/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentspace-so-wan-2-7/security.svg)](https://skillstore.io/skills/agentspace-so-wan-2-7?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentspace-so-wan-2-7?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentspace-so-wan-2-7/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentspace-so-wan-2-7.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

agentspace-so. (2026). wan-2-7 security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/agentspace-so-wan-2-7/audits/8

BibTeX citation

@techreport{agentspace-so-agentspace-so-wan-2-7-2026, author = {agentspace-so}, title = {wan-2-7 security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/agentspace-so-wan-2-7/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "wan-2-7 security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "agentspace-so" date-released: "2026-07-09" url: "https://skillstore.io/skills/agentspace-so-wan-2-7/audits/8" identifiers: - type: other value: "skillstore:agentspace-so-wan-2-7:audit:8" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
runcomfy-com Recommended

runcomfy-com-wan-2-7

Skillstore Score 78
Evidence Confidence High
Skillstore usage 12
Updated

2026-08-21

doany-ai-wan-2-7

Skillstore Score 50
Evidence Confidence High
Skillstore usage 8
Updated

2026-08-21

agentspace-so-wan-2-7

Skillstore Score 50
Evidence Confidence High
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
68
Community
91
Spec Compliance

What You Can Build

Create Product Showcase Clips

Prepare concise Wan 2.7 prompts for short product videos with controlled camera motion, duration, and aspect ratio.

Produce Lip-Synced Voiceover Variants

Use an audio URL with matching duration settings to create short spokesperson or localization clips.

Test Prompt and Seed Variations

Iterate negative prompts, prompt expansion, and seed values while keeping the RunComfy request structure consistent.

Try These Prompts

Create a Basic Clip
Create a Wan 2.7 request for a five second 1080p product video. Include camera motion, one main action, aspect ratio, and output directory guidance.
Add Lip Sync
Prepare a Wan 2.7 lip-sync video request using this audio URL: [audio URL]. Match the duration, choose the aspect ratio, and include prompt details for a stable close-up shot.
Control Prompt Expansion
Build a Wan 2.7 request that keeps my prompt literal. Disable prompt expansion, add a focused negative prompt, and explain which fields affect consistency.
Plan Production Variants
Design three Wan 2.7 variants for the same concept. Keep the core prompt stable, vary seed and framing choices, and summarize expected tradeoffs for review.

Best Practices

  • Use one primary action per clip and describe camera movement early in the prompt.
  • Keep audio files within the documented duration, size, and format limits before using lip sync.
  • Confirm the output directory and remote service before running RunComfy CLI commands.

Avoid

  • Do not combine many unrelated actions in one short clip.
  • Do not use vague negative prompts such as requests for better quality without specific defects.
  • Do not submit confidential prompts, private media URLs, or tokens in shared chats.

Frequently Asked Questions

Does this skill generate videos locally?
No. It prepares and runs requests through the RunComfy CLI against RunComfy hosted Model API.
What credentials are required?
You need a RunComfy account login or a RunComfy token configured for the CLI environment.
Can I use my own audio?
Yes. The skill documents audio URL input for lip-sync generation with WAV or MP3 files within the stated limits.
What output limits should I expect?
The documented guidance supports short clips up to 15 seconds, 720p or 1080p resolution, and five aspect ratios.
Can I disable prompt expansion?
Yes. The skill explains when to disable prompt expansion for literal or brand-strict prompts.
Is sensitive media safe to send?
Treat RunComfy as a third-party processor. Do not send confidential prompts, audio, or private media URLs unless approved.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

3 downloads ยท 94 views

File structure

๐Ÿ“„ SKILL.md

More from agentspace-so

View all
View all