Audit History

SKILL.md:23-25 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Ruby/shell backtick execution

instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through

The skill states it calls the local RunComfy CLI for Wan 2.7 video generation. That is real external command execution and sends work to a hosted service.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced snippet runs npx to install a skill globally from a GitHub source. Global package or skill installation is external command execution with supply-chain impact.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite tells users to install the RunComfy CLI globally with npm. Installing global packages can execute package lifecycle code and modifies the host environment.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite tells users to run the RunComfy login command, which launches an authentication flow and changes local credential state. It is legitimate but still external command execution.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The prose confirms the skill invokes the RunComfy CLI, posts to the model API, polls the request, and downloads results. That confirms the external command and network workflow.

Medium

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The line confirms the login command writes an API token to a local config path. It documents a credential-changing command, so the external command usage is security-sensitive.

Medium

SKILL.md:177 SKILL.md:183

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The line identifies the concrete RunComfy model API endpoint and output download domains. This is intended behavior, but it is real outbound network traffic.

Audited by: codex

Audit version 7

Jul 9, 2026, 08:17 AM

Most static backtick findings are Markdown formatting false positives, but the skill does document real RunComfy CLI execution and a hosted API workflow. I confirmed the external command and outbound network risks, found no prompt injection attempt, and found no malicious hidden-file behavior.

1

Files scanned

186

Lines analyzed

14

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

Third-Party Prompt and Media Transfer

The skill sends the prompt body to RunComfy hosted Model API and says external media URLs are fetched by RunComfy model servers. Users could expose confidential prompts, audio, or private media URLs to a third party.

The workflow explicitly describes posting requests to RunComfy and server-side fetching of supplied URLs. This is clear privacy and data-handling risk, although it is documented and expected.

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23-25 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Ruby/shell backtick execution

instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through

The skill states it calls the local RunComfy CLI for Wan 2.7 video generation. That is real external command execution and sends work to a hosted service.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced snippet runs npx to install a skill globally from a GitHub source. Global package or skill installation is external command execution with supply-chain impact.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite tells users to install the RunComfy CLI globally with npm. Installing global packages can execute package lifecycle code and modifies the host environment.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite tells users to run the RunComfy login command, which launches an authentication flow and changes local credential state. It is legitimate but still external command execution.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The prose confirms the skill invokes the RunComfy CLI, posts to the model API, polls the request, and downloads results. That confirms the external command and network workflow.

Medium

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The line confirms the login command writes an API token to a local config path. It documents a credential-changing command, so the external command usage is security-sensitive.

Medium

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The line identifies the concrete RunComfy model API endpoint and output download domains. This is intended behavior, but it is real outbound network traffic.

Audited by: codex

Audit version 6

Jul 9, 2026, 05:47 AM

Most static findings are Markdown false positives from inline code spans, tables, and fenced examples. The confirmed risks are expected for this skill: it instructs users to install and run the RunComfy CLI, submit prompts and media references to RunComfy, and store an API token locally.

1

Files scanned

186

Lines analyzed

16

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:177-184

Third-party prompt and media processing

The skill sends prompts, audio_url values, and generated output handling to RunComfy infrastructure. Users may expose sensitive creative briefs, voice tracks, or media URLs to a third-party model service.

The security section explicitly describes POST requests to model-api.runcomfy.net and third-party URL fetching by RunComfy servers. This is normal for the service, but it is an intent-level privacy risk.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

Hidden file in home directory

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The skill documents storage of an API token under ~/.config/runcomfy/token.json. The file is owner-only, but it is still sensitive credential material stored on disk.

Medium

SKILL.md:23-25 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Ruby/shell backtick execution

instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through

The skill states that it calls the local RunComfy CLI. This is a real external command dependency, although it is expected for this video generation workflow.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced block includes an npx installation command for the skill package. It is legitimate documentation, but it instructs package execution from npm and should remain visible as an external command risk.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite instructs users to install @runcomfy/cli globally with npm. This is a real package installation command and carries normal supply-chain and local execution risk.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite instructs users to run runcomfy login. This is legitimate authentication setup, but it executes a local CLI and starts a browser device-code flow.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The implementation notes confirm the skill invokes runcomfy run with a JSON body. This validates the external command behavior rather than a mere formatting match.

Medium

Ruby/shell backtick execution

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The line references runcomfy login as the action that writes a local API token. It is a legitimate CLI command, but it is tied to credential storage and should remain visible.

Medium

Hidden file access

- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m

The skill documents access to a hidden configuration path for the RunComfy token. The mode 0600 mitigation is good, but the hidden credential file is real.

Low

SKILL.md:23-25 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The line documents that the CLI posts to model-api.runcomfy.net and downloads output URLs. This is expected for the service, but it is real outbound network behavior.

Audited by: claude

Audit version 5

Jul 9, 2026, 01:12 AM

The skill is primarily documentation for using the RunComfy CLI with Wan 2.7. Confirmed risks are the intentional execution of external RunComfy commands and documented outbound API traffic; most static hits are markdown formatting or safe inline examples.

1

Files scanned

186

Lines analyzed

12

Review items

0

False positives ignored

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

This location documents commands that install or invoke the RunComfy CLI. The commands are intentional, but they require executing external software and sending job data to a third-party service.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

This location documents commands that install or invoke the RunComfy CLI. The commands are intentional, but they require executing external software and sending job data to a third-party service.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

This location documents commands that install or invoke the RunComfy CLI. The commands are intentional, but they require executing external software and sending job data to a third-party service.

Medium

SKILL.md:45

Ruby/shell backtick execution

3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>` instead of `runcomfy login`.

This location documents commands that install or invoke the RunComfy CLI. The commands are intentional, but they require executing external software and sending job data to a third-party service.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

This location documents commands that install or invoke the RunComfy CLI. The commands are intentional, but they require executing external software and sending job data to a third-party service.

Low

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

This line documents that the CLI posts requests to the RunComfy Model API and downloads generated results from RunComfy domains. The outbound network behavior is intended but materially relevant for users.

Audited by: claude

Audit version 4

Jul 8, 2026, 12:59 AM

Most static findings are Markdown backtick false positives from inline parameters, fenced examples, and links. Confirmed risks are the intended RunComfy CLI execution, npm or npx installation guidance, and outbound RunComfy API submission and download behavior. No prompt injection attempt or hidden malicious intent was found in SKILL.md.

1

Files scanned

186

Lines analyzed

12

Review items

0

False positives ignored

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:23-25 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Ruby/shell backtick execution

instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through

This line states that the skill calls the RunComfy CLI to generate video. That is intentional local external command execution with network side effects.

Medium

Ruby/shell backtick execution · 4 occurrences

```bash

The fenced block includes an npx command to add the skill globally. npx and global installation can execute third-party package code and change the host environment.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

This prerequisite tells users to install @runcomfy/cli globally with npm. Global CLI installation runs third-party package code and changes the local toolchain.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

This prerequisite runs runcomfy login, which starts an authentication flow and creates local credentials. It is expected setup but remains a security-sensitive external command.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The implementation description confirms the skill invokes runcomfy run and posts to the RunComfy model API. This is an intended command path with outbound network and file download side effects.

Low

SKILL.md:66-69 SKILL.md:74-82 SKILL.md:87-94 SKILL.md:182

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

This line names the RunComfy model API and output download domains. The external network flow is intended but submits prompts or media references and downloads generated files.

Audited by: codex

Audit version 3

Jul 5, 2026, 01:49 AM

Most static findings are Markdown backtick false positives around inline parameters, code fences, and documentation links. The real risks are RunComfy CLI execution, remote transfer of prompts and media references, and unsafe shell interpolation examples. No prompt injection attempt was found in the reviewed skill file.

1

Files scanned

186

Lines analyzed

14

Review items

0

False positives ignored

Confirmed security concerns (2)

High

Unsafe Shell Interpolation Guidance

Command examples place user prompt values inside shell-quoted JSON. A prompt containing quotes could break the shell string if an agent interpolates it directly.

The examples pass prompt data through a shell command string, while the safety note only covers CLI transmission after shell parsing. This leaves a clear injection risk if raw user input is substituted.

Medium

SKILL.md:177 SKILL.md:182-184

Third-Party Prompt And Media Transfer

The skill sends prompts and media references to RunComfy and states that RunComfy servers fetch external media URLs. This can expose private creative data.

The file explicitly states that the CLI posts the JSON body to RunComfy and that third-party URLs are fetched by RunComfy servers. This confirms the privacy boundary.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95

Ruby/shell backtick execution · 3 occurrences

```bash

The shell example embeds user prompt data inside quoted JSON. Direct interpolation could break shell quoting and allow command injection.

Medium

Ruby/shell backtick execution

instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through

The line describes the intended RunComfy CLI call. That creates a real external command surface, although it is expected for this skill.

Medium

SKILL.md:23-25

Ruby/shell backtick execution

```bash

The fenced example contains an npx global install command. Running network-fetched installer commands is security-relevant even when user-initiated.

Medium

Ruby/shell backtick execution

1. **RunComfy CLI** — `npm i -g @runcomfy/cli`

The prerequisite instructs global installation of the RunComfy CLI from npm. Global CLI installation is a real supply-chain and execution surface.

Medium

Ruby/shell backtick execution

2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.

The prerequisite instructs the user to run RunComfy login. This creates account credentials for the CLI and is security-relevant.

Medium

Ruby/shell backtick execution

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The prose states that the skill invokes the RunComfy CLI to submit jobs. This confirms real external command execution and remote job handling.

Medium

SKILL.md:66-70 SKILL.md:74-83 SKILL.md:177 SKILL.md:184

Hardcoded URL

The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.

The line names the RunComfy Model API endpoint used for job submission and polling. This is a real outbound network dependency.

Audited by: codex

Audit version 2

Jun 28, 2026, 05:34 AM

Static analysis reported many high-risk patterns, but most are false positives from Markdown backticks, endpoint documentation, and ordinary prose. The confirmed risk is that the skill intentionally invokes the RunComfy CLI, sends prompts and optional media URLs to RunComfy over HTTPS, and documents local token storage, so publication should include a network and credential-handling warning.

1

Files scanned

186

Lines analyzed

7

Review items

2

False positives ignored

Confirmed security concerns (1)

Low

SKILL.md:39

System Reconnaissance Alert Is Model Routing Guidance

The system reconnaissance finding points to a sentence telling the assistant when to route requests to this model. It does not collect host, user, process, or network information.

The cited line is plain routing guidance inside the skill instructions. No reconnaissance command or environment inspection is present.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

External Model API Invocation

The skill instructs the assistant to run the RunComfy CLI for Wan 2.7 video generation. This is intended behavior, but it sends user prompts and optional audio or media URLs to an external RunComfy model service.

The CLI command and outbound RunComfy endpoint are explicitly documented. The behavior appears legitimate for this skill, but it is a real third-party data transfer risk.

Medium

SKILL.md:43-45 SKILL.md:181

Credential Storage and Environment Token Guidance

The skill documents RunComfy authentication through browser login or RUNCOMFY_TOKEN. It also states that login writes an API token to a hidden config path in the user home directory.

The token location and environment-variable option are directly described in the skill. This is normal CLI credential handling, but users must protect the token.

Low

SKILL.md:78

Path Traversal Alert Is Placeholder URL Text

The path traversal finding points to an example audio URL placeholder. It does not instruct filesystem traversal and is not used as a local path.

Line 78 is an HTTPS audio_url example with ellipsis text. There is no file-read operation or traversal sequence applied to the local filesystem.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:7 SKILL.md:10 SKILL.md:23-25 SKILL.md:49-60 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95 SKILL.md:177

Static Command Execution Alerts Are Markdown Examples

The static analyzer flagged many backtick and shell-command patterns. Review found these are Markdown inline code, tables, and fenced examples for the documented RunComfy workflow, not embedded executable Ruby or hidden script code.

The file is Markdown and contains no Ruby source or executable helper files. The flagged lines are documentation examples or inline command names.

Low

SKILL.md:4 SKILL.md:112 SKILL.md:162

Weak Cryptography Alerts Are False Positives

The static analyzer reported weak cryptographic algorithm blockers, but the cited lines contain frontmatter prose, anti-pattern text, and an exit-codes heading. No cryptographic operation or hashing algorithm use was found in the skill file.

The cited locations do not contain crypto code or algorithm selection. The signal appears to come from substring matching in ordinary Markdown text.

Risk Factors

⚙️ External commands (5)

SKILL.md:43 SKILL.md:66-70 SKILL.md:74-83 SKILL.md:87-95 SKILL.md:177

🌐 Network access (6)

SKILL.md:13 SKILL.md:19 SKILL.md:78 SKILL.md:173 SKILL.md:177 SKILL.md:184

📁 Filesystem access (4)

SKILL.md:69 SKILL.md:82 SKILL.md:94 SKILL.md:181

Detected Patterns

CLI Execution With External Network EffectsHidden Credential File Reference

Audited by: codex

Audit version 1

May 5, 2026, 08:55 AM

Static analysis flagged 72 potential issues, primarily Ruby backtick patterns in markdown documentation. Manual review confirms all external_command detections are false positives - the backticks are markdown code formatting, not actual code execution. The skill is a legitimate RunComfy CLI wrapper for video generation. No command injection vulnerabilities exist. Network calls are to documented RunComfy API endpoints only. Token storage uses secure file permissions (0600).

1

Files scanned

186

Lines analyzed

7

Review items

0

False positives ignored

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:7-184

External Command Execution Documentation

SKILL.md documents CLI commands using backtick syntax for markdown formatting. The static scanner flagged these as 'Ruby backtick execution' patterns. All 58 detections are false positives - the skill contains only documentation examples, not executable code. The RunComfy CLI is invoked with structured JSON input, not shell-expanded prompts.

All flagged patterns are markdown documentation examples with backtick-wrapped CLI commands, not Ruby code. The skill file contains no Ruby interpreter or shell execution logic.

Low

SKILL.md:13 SKILL.md:19 SKILL.md:78 SKILL.md:173

Hardcoded Service URLs

Documentation references hardcoded RunComfy service URLs (runcomfy.com, model-api.runcomfy.net). These are expected for a platform-specific CLI wrapper and pose no security risk.

URLs are documented service endpoints for the RunComfy platform, not malicious or exfiltration targets.

Low

SKILL.md:4 SKILL.md:39 SKILL.md:112

Local Token Storage Path

Token stored at ~/.config/runcomfy/token.json with mode 0600 permissions. This is secure local credential storage with proper file permissions.

Token storage uses owner-only read/write permissions (0600), which is the secure approach for credential storage.

Low

Static Analyzer Crypto/Reconnaissance Flags

The static scanner flagged weak crypto algorithms at lines 4, 112, 162 and system reconnaissance at line 39. Manual review shows these are documentation text - displayName, negative prompt guidance, and trigger keywords respectively. No cryptographic operations or reconnaissance activities exist.

Scanner misidentified documentation text as code patterns. No actual crypto or system reconnaissance in this skill.

Risk Factors

⚙️ External commands (1)

SKILL.md:7-184

🌐 Network access (3)

SKILL.md:13 SKILL.md:19 SKILL.md:177

📁 Filesystem access (1)