Skills image-to-video
📦
image-to-video
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Animate Still Images with RunComfy
Choosing the right image-to-video model can waste credits and time. This skill routes each request to a RunComfy model and supplies model-specific prompts.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "image-to-video" from https://skillstore.io/skills/doany-ai-image-to-video.md and its manifest at https://skillstore.io/api/skills/doany-ai-image-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "image-to-video". A portrait photo needs subtle movement while preserving identity.
Expected outcome:
The skill selects HappyHorse 1.0 I2V, recommends a short 1080P clip, and drafts a motion-focused prompt.
Using "image-to-video". A headshot and voiceover URL are provided for a vertical ad.
Expected outcome:
The skill selects Wan 2.7 with custom audio, matches duration to the voiceover, and suggests useful negative prompts.
Using "image-to-video". A subject image, cafe video, and voice reference should guide one clip.
Expected outcome:
The skill selects Seedance 2.0 Pro and maps the references to subject, scene, and voice cues.
Security Audit
High Riskv4 • 7/5/2026 Open versioned report
Most static detections are false positives caused by Markdown backticks, placeholder URLs, and example field names. Confirmed risks remain for intentional external CLI execution, token persistence, third-party media processing, and an installation-source mismatch.
1
Files scanned
206
Lines analyzed
11
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Installation Source Mismatch
The skill links to and installs agentspace-so/runcomfy-skills while this marketplace package is audited from a different source. Users could be routed to unaudited code.
The GitHub link and npx install command both name agentspace-so/runcomfy-skills. The report source identifies a different repository, so the mismatch is explicit.
Medium
Third-Party Media and Prompt Transfer
The skill states that the CLI posts requests to RunComfy and that RunComfy servers fetch user media URLs. Sensitive prompts or media can leave the local environment.
The security notes directly describe remote API submission, server-side media fetching, and outbound RunComfy endpoints. This supports a privacy-risk finding.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The skill documents that the RunComfy CLI stores an API token under a hidden home-directory config path. Mode 0600 reduces exposure, but the persisted credential is still a real risk.
Medium
Ruby/shell backtick execution
model. Calls `runcomfy run <vendor>/<model>/image-to-video` (or
The skill explicitly directs agents to invoke the local RunComfy CLI. This is disclosed and central to the skill, but it executes external software and submits remote jobs.
Medium
Ruby/shell backtick execution
```bash
The fenced example contains an npx-based global skill install command. Global installs from a repository are legitimate setup steps, but they create supply-chain and execution risk.
Medium
Ruby/shell backtick execution
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`
The prerequisite instructs users to install a global npm CLI package. This is an intentional setup command with standard third-party package execution risk.
Medium
Ruby/shell backtick execution
2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
The login command invokes the external RunComfy CLI and initiates an account authentication flow. This is expected behavior, but it affects local credentials.
Medium
Ruby/shell backtick execution
```bash
The code block shows a RunComfy CLI invocation that sends an image-to-video job to a remote service. It is intentional, but still requires external command and network trust.
Medium
Ruby/shell backtick execution
```bash
The code block shows a RunComfy CLI invocation for a remote lip-sync video job. It is legitimate for the skill, but it executes an external CLI with user-provided media inputs.
Medium
Ruby/shell backtick execution
```bash
The code block shows a RunComfy CLI invocation for a remote multi-modal generation job. It is legitimate for the skill, but it runs external tooling with media references.
Medium
Ruby/shell backtick execution
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user inten
The skill states that it invokes runcomfy run and that the CLI posts requests and downloads generated output. This confirms real external command use and remote processing.
Medium
Ruby/shell backtick execution
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The line references runcomfy login and local token handling. The command is expected, but it stores authentication material through an external CLI.
Medium
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The documented token file is hidden configuration containing API credentials. The access pattern is standard but security-relevant because compromise of the account can expose the token.
Risk Factors
⚙️ External commands (51)
SKILL.md:9 SKILL.md:13 SKILL.md:27-29 SKILL.md:29-38 SKILL.md:38-39 SKILL.md:39 SKILL.md:48-49 SKILL.md:49-50 SKILL.md:50-57 SKILL.md:57-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-74 SKILL.md:74-81 SKILL.md:81-93 SKILL.md:93-95 SKILL.md:95 SKILL.md:103-104 SKILL.md:104-105 SKILL.md:105 SKILL.md:106 SKILL.md:107 SKILL.md:108-109 SKILL.md:109-113 SKILL.md:113-122 SKILL.md:122-127 SKILL.md:127-128 SKILL.md:128 SKILL.md:129-135 SKILL.md:135-143 SKILL.md:143-144 SKILL.md:144 SKILL.md:145 SKILL.md:146 SKILL.md:147 SKILL.md:148-149 SKILL.md:149 SKILL.md:150-151 SKILL.md:151-155 SKILL.md:155-165 SKILL.md:165-169 SKILL.md:169 SKILL.md:170-180 SKILL.md:180 SKILL.md:197 SKILL.md:201 SKILL.md:202-204 SKILL.md:204
🌐 Network access (8)
📁 Filesystem access (7)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/doany-ai-image-to-video/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/doany-ai-image-to-video?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/doany-ai-image-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doany-ai-image-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/doany-ai-image-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
doany-ai. (2026). image-to-video security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/doany-ai-image-to-video/audits/4BibTeX citation
@techreport{doany-ai-doany-ai-image-to-video-2026,
author = {doany-ai},
title = {image-to-video security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/doany-ai-image-to-video/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-to-video security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "doany-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/doany-ai-image-to-video/audits/4"
identifiers:
- type: other
value: "skillstore:doany-ai-image-to-video:audit:4"
description: "Skillstore immutable audit report identifier"
Compare variants
8 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
runcomfy-com Recommended
runcomfy-com-image-to-video
Skillstore Score 78
Evidence Confidence High
Skillstore usage 30
Updated
2026-08-21
genmedia-labs-image-to-video
Skillstore Score 74
Evidence Confidence Medium
Skillstore usage 2
Updated
2026-08-21
halt-catch-fire-image-to-video
Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 7
Updated
2026-08-21
101-skills-image-to-video
Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 4
Updated
2026-08-21
skills-collective-image-to-video
Skillstore Score 50
Evidence Confidence Medium
Skillstore usage 1
Updated
2026-08-21
doany-ai Current
doany-ai-image-to-video
Skillstore Score 38
Evidence Confidence High
Skillstore usage 15
Updated
2026-08-21
agentspace-so-image-to-video
Skillstore Score 38
Evidence Confidence High
Skillstore usage 5
Updated
2026-08-21
inference-sh-9-image-to-video
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 13
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance
What You Can Build
Create Product Motion Clips
Turn product stills into short reveal, orbit, or macro-motion clips with model-specific prompt guidance.
Generate Voiceover Variants
Route portrait or spokesperson requests to a lip-sync workflow when a custom audio URL is available.
Blend Reference Media
Use subject images, scene videos, and audio references to plan multi-modal RunComfy generation requests.
Try These Prompts
Basic Still Animation
Animate this image URL: [image URL]. Use gentle motion, keep the subject stable, and save the result to [output folder].
Product Reveal Clip
Create a short product reveal from [image URL]. Use a slow orbit, stable packaging text, clean lighting, and a five-second duration.
Custom Voiceover Lip-Sync
Animate a spokesperson using [portrait image URL] and lip-sync to [audio URL]. Match the clip length to the audio and avoid subtitles.
Multi-Modal Reference Plan
Use [subject image], [scene video], and [voice audio] to create one clip. Preserve subject identity and follow the reference scene mood.
Best Practices
- Use one main motion beat per clip so the model has a clear visual goal.
- Keep identity, branding, and geometry preservation goals explicit in the prompt.
- Confirm consent before sending private images, voice recordings, or brand assets to RunComfy.
Avoid
- Do not submit confidential media URLs without reviewing RunComfy handling requirements.
- Do not mix unrelated visual styles across reference images and videos.
- Do not request one clip that requires several model routes at once.
Frequently Asked Questions
Which model does the skill use by default?
It defaults to HappyHorse 1.0 I2V for general still-image animation requests.
Can it use a custom voiceover?
Yes. It routes custom voiceover lip-sync requests to the Wan 2.7 workflow with an audio URL.
Can it combine image, video, and audio references?
Yes. It uses Seedance 2.0 Pro guidance for multi-modal reference workflows.
Does it generate video locally?
No. It uses the local RunComfy CLI to submit jobs to RunComfy remote services.
What setup is required?
Users need the RunComfy CLI, a RunComfy account, authentication, and valid source media URLs.
What privacy concern should users review?
Prompts and media references may be processed by RunComfy services, so sensitive assets need extra review.