Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 8:17:54 AM

wan-2-7 security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
wan-2-7
Version
v8
Maintainer
agentspace-so
Source
github.com/agentspace-so/runcomfy-agent-skills/tree/main/wan-2-7/
Coverage
1 Files scanned · 186 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static backtick findings are Markdown formatting false positives, but the skill does document real RunComfy CLI execution and a hosted API workflow. I confirmed the external command and outbound network risks, found no prompt injection attempt, and found no malicious hidden-file behavior.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 186 Lines analyzed

11 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 39 evidence locations

Capability review items (10)
Medium
SKILL.md:10
Ruby/shell backtick execution
instead. Calls `runcomfy run wan-ai/wan-2-7/text-to-video` through
The skill states it calls the local RunComfy CLI for Wan 2.7 video generation. That is real external command execution and sends work to a hosted service.
Medium
SKILL.md:23-25
Ruby/shell backtick execution
```bash
The fenced snippet runs npx to install a skill globally from a GitHub source. Global package or skill installation is external command execution with supply-chain impact.
Medium
SKILL.md:43-44
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite tells users to install the RunComfy CLI globally with npm. Installing global packages can execute package lifecycle code and modifies the host environment.
Medium
SKILL.md:44-45
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The prerequisite tells users to run the RunComfy login command, which launches an authentication flow and changes local credential state. It is legitimate but still external command execution.
Medium
SKILL.md:66-70
Ruby/shell backtick execution
```bash
The default invocation runs the RunComfy CLI with user prompt input and an output directory. This is intended behavior, but it is real local command execution.
Medium
SKILL.md:74-83
Ruby/shell backtick execution
```bash
The audio-driven example runs the RunComfy CLI with prompt and audio URL inputs. It is intended behavior, but it combines local command execution with remote media processing.
Medium
SKILL.md:87-95
Ruby/shell backtick execution
```bash
The literal-control example runs the RunComfy CLI and passes user-controlled generation settings. This is real external command execution even though the command is documented.
Medium
SKILL.md:177
Ruby/shell backtick execution
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The prose confirms the skill invokes the RunComfy CLI, posts to the model API, polls the request, and downloads results. That confirms the external command and network workflow.
Medium
SKILL.md:181
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The line confirms the login command writes an API token to a local config path. It documents a credential-changing command, so the external command usage is security-sensitive.
Medium
SKILL.md:177
Hardcoded URL
The skill invokes `runcomfy run wan-ai/wan-2-7/text-to-video` with a JSON body matching the schema.
The line identifies the concrete RunComfy model API endpoint and output download domains. This is intended behavior, but it is real outbound network traffic.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:177SKILL.md:183
Third-Party Prompt and Media Transfer
The skill sends the prompt body to RunComfy hosted Model API and says external media URLs are fetched by RunComfy model servers. Users could expose confidential prompts, audio, or private media URLs to a third party.
The workflow explicitly describes posting requests to RunComfy and server-side fetching of supplied URLs. This is clear privacy and data-handling risk, although it is documented and expected.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    External CLI commands are required for generation.
    Show the exact RunComfy command, destination service, and output directory before execution. Require explicit user approval before running installs, login, or generation commands.
  2. FIX-002
    Medium
    Prompts and media references are processed by a third-party service.
    Warn users not to submit confidential prompts, private audio, or restricted media URLs unless their organization approves RunComfy data handling.
  3. FIX-003
    Low
    Credential handling depends on local RunComfy CLI behavior.
    Document token storage and recommend environment tokens for CI. Do not read, print, or copy the token file from the skill workflow.
  4. FIX-004
    Low
    The placeholder audio URL resembles a path traversal pattern to static scanners.
    Replace https://.../voiceover.mp3 with a neutral placeholder such as an example.com media URL.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Content hash
0c38b830e5a8273b62e61069161af937441dc0bedd5567da8032ebec88e6f6b9
Tree hash
488cc712067a56e5655d035e27a0606b1a98a310bfda4bc537060f700f305202
Skill path
skills/agentspace-so/wan-2-7
Audit payload hash
a9d80fd346f9cd9c69e919e6b9cfbbc6

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable