Versioned security assessment

Report ID: SA-16DD4E1E

7/9/2026, 5:47:29 AM

wan-2-7 security assessment v6

Skill Security Certification Report

Audit History
Audit model: claude Historical report
Skill name
wan-2-7
Version
v6
Maintainer
agentspace-so
Source
github.com/agentspace-so/runcomfy-agent-skills/tree/main/wan-2-7/
Coverage
1 Files scanned · 186 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown false positives from inline code spans, tables, and fenced examples. The confirmed risks are expected for this skill: it instructs users to install and run the RunComfy CLI, submit prompts and media references to RunComfy, and store an API token locally.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 186 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 39 evidence locations

Capability review items (12)
High
SKILL.md:181
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents storage of an API token under ~/.config/runcomfy/token.json. The file is owner-only, but it is still sensitive credential material stored on disk.
Medium
SKILL.md:10
Ruby/shell backtick execution
instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through
The skill states that it calls the local RunComfy CLI. This is a real external command dependency, although it is expected for this video generation workflow.
Medium
SKILL.md:23-25
Ruby/shell backtick execution
```bash
The fenced block includes an npx installation command for the skill package. It is legitimate documentation, but it instructs package execution from npm and should remain visible as an external command risk.
Medium
SKILL.md:43-44
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite instructs users to install @runcomfy/cli globally with npm. This is a real package installation command and carries normal supply-chain and local execution risk.
Medium
SKILL.md:44-45
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The prerequisite instructs users to run runcomfy login. This is legitimate authentication setup, but it executes a local CLI and starts a browser device-code flow.
Medium
SKILL.md:66-70
Ruby/shell backtick execution
```bash
The example invokes runcomfy run with user-provided prompt JSON and an output directory. This is expected behavior, but it is real external command execution.
Medium
SKILL.md:74-83
Ruby/shell backtick execution
```bash
The lip-sync example invokes runcomfy run with prompt, audio_url, duration, and aspect_ratio inputs. This is legitimate, but it executes a third-party CLI and submits data remotely.
Medium
SKILL.md:87-95
Ruby/shell backtick execution
```bash
The literal-control example invokes runcomfy run with prompt controls. It is expected documentation, but still represents real external command execution.
Medium
SKILL.md:177
Ruby/shell backtick execution
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The implementation notes confirm the skill invokes runcomfy run with a JSON body. This validates the external command behavior rather than a mere formatting match.
Medium
SKILL.md:181
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The line references runcomfy login as the action that writes a local API token. It is a legitimate CLI command, but it is tied to credential storage and should remain visible.
Medium
SKILL.md:181
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents access to a hidden configuration path for the RunComfy token. The mode 0600 mitigation is good, but the hidden credential file is real.
Low
SKILL.md:177
Hardcoded URL
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The line documents that the CLI posts to model-api.runcomfy.net and downloads output URLs. This is expected for the service, but it is real outbound network behavior.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:177-184
Third-party prompt and media processing
The skill sends prompts, audio_url values, and generated output handling to RunComfy infrastructure. Users may expose sensitive creative briefs, voice tracks, or media URLs to a third-party model service.
The security section explicitly describes POST requests to model-api.runcomfy.net and third-party URL fetching by RunComfy servers. This is normal for the service, but it is an intent-level privacy risk.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    RunComfy login stores an API token in a local config file.
    Keep the token file owner-only, prefer RUNCOMFY_TOKEN in ephemeral CI environments, and rotate the token if the machine is shared or compromised.
  2. FIX-002
    Medium
    External CLI installation and execution are required.
    Tell users to install @runcomfy/cli only from the official package source and review the command before running it.
  3. FIX-003
    Medium
    Prompts and media URLs are sent to RunComfy infrastructure.
    Warn users not to submit confidential scripts, private voice recordings, or non-public media URLs unless their RunComfy account permits that use.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable