Versioned security assessment

Report ID: SA-62E2A730

7/5/2026, 9:37:16 PM

face-swap security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
face-swap
Version
v3
Maintainer
runcomfy-com
Source
github.com/runcomfy-com/skills/tree/main/face-swap/
Coverage
1 Files scanned · 321 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives caused by Markdown code fences, inline model names, documentation links, and routing guidance. The real risks are persistent token storage, external processing of biometric media, untrusted reference assets, and the dual-use impersonation potential of face-swap workflows.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 321 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 35 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 58 evidence locations

Capability review items (2)
High
SKILL.md:304
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
Line 304 documents that runcomfy login stores an API token under ~/.config/runcomfy/token.json. This is legitimate credential storage, but it creates a real secret-at-rest risk on shared or compromised hosts.
Medium
SKILL.md:304
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The hidden config path contains a RunComfy API token. The skill does not exfiltrate it, but creating or relying on that hidden token file is security-sensitive.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:55-62SKILL.md:300-302
Unrestricted Face-Swap Workflow Can Enable Impersonation
The skill is designed to substitute identities in images and video and states that the model API will run supplied inputs without gating. This can enable non-consensual impersonation, defamatory synthetic media, or sexual abuse if the operator ignores the refusal guidance.
The file explicitly describes face and character substitution and warns that the API itself does not gate inputs. The misuse path is direct and acknowledged by the skill author.
RISK-002 Medium
SKILL.md:298-309
External Processing of Biometric Media
The skill sends image, audio, and video assets to the RunComfy Model API and downloads generated results from RunComfy domains. Face, voice, and performance media are sensitive biometric data and require clear user consent before upload.
Line 298 describes POSTing to the Model API and downloading RunComfy results. The surrounding sections identify face, audio, and video assets as the processed inputs.
RISK-003 Medium
SKILL.md:306-308
Untrusted Reference Assets Can Influence Outputs
The skill acknowledges that third-party reference image, audio, and video URLs are untrusted and that face-swap pipelines can be targeted through reference-asset injection. This can produce identity, motion, or behavior that diverges from the operator prompt.
The risk is explicitly documented in the skill text, including a warning that reference assets are untrusted and should be suspected when output diverges from the prompt.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Face-swap requests can target real people without enforceable consent.
    Add explicit pre-run consent checks and refuse real-person, sexual, defamatory, political, or deceptive impersonation requests.
  2. FIX-002
    High
    RunComfy API tokens are stored in a hidden local config file.
    Document token cleanup, avoid shared machines, prefer RUNCOMFY_TOKEN in CI, and never read or print token file contents.
  3. FIX-003
    Medium
    Biometric media is sent to external model APIs.
    Warn users before upload, accept only user-provided assets, and require clear consent for face, voice, and performance media.
  4. FIX-004
    Medium
    Third-party reference URLs can influence generated output.
    Use trusted HTTPS sources, reject unexpected assets, and review output divergence before publishing generated media.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable