Versioned security assessment

Report ID: SA-62E2A730

7/5/2026, 9:37:16 PM

face-swap security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
face-swap
Version
v4
Maintainer
runcomfy-com
Source
github.com/runcomfy-com/skills/tree/main/face-swap/
Coverage
1 Files scanned · 321 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives caused by Markdown code fences, inline model names, documentation links, and routing guidance. The real risks are persistent token storage, external processing of biometric media, untrusted reference assets, and the dual-use impersonation potential of face-swap workflows.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 321 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 35 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 58 evidence locations

Capability review items (2)
High
SKILL.md:304
Hidden file in home directory
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
Line 304 documents that runcomfy login stores an API token under ~/.config/runcomfy/token.json. This is legitimate credential storage, but it creates a real secret-at-rest risk on shared or compromised hosts.
Medium
SKILL.md:304
Hidden file access
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with m
The hidden config path contains a RunComfy API token. The skill does not exfiltrate it, but creating or relying on that hidden token file is security-sensitive.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:55-62SKILL.md:300-302
Unrestricted Face-Swap Workflow Can Enable Impersonation
The skill is designed to substitute identities in images and video and states that the model API will run supplied inputs without gating. This can enable non-consensual impersonation, defamatory synthetic media, or sexual abuse if the operator ignores the refusal guidance.
The file explicitly describes face and character substitution and warns that the API itself does not gate inputs. The misuse path is direct and acknowledged by the skill author.
RISK-002 Medium
SKILL.md:298-309
External Processing of Biometric Media
The skill sends image, audio, and video assets to the RunComfy Model API and downloads generated results from RunComfy domains. Face, voice, and performance media are sensitive biometric data and require clear user consent before upload.
Line 298 describes POSTing to the Model API and downloading RunComfy results. The surrounding sections identify face, audio, and video assets as the processed inputs.
RISK-003 Medium
SKILL.md:306-308
Untrusted Reference Assets Can Influence Outputs
The skill acknowledges that third-party reference image, audio, and video URLs are untrusted and that face-swap pipelines can be targeted through reference-asset injection. This can produce identity, motion, or behavior that diverges from the operator prompt.
The risk is explicitly documented in the skill text, including a warning that reference assets are untrusted and should be suspected when output diverges from the prompt.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Face-swap requests can target real people without enforceable consent.
    Add explicit pre-run consent checks and refuse real-person, sexual, defamatory, political, or deceptive impersonation requests.
  2. FIX-002
    High
    RunComfy API tokens are stored in a hidden local config file.
    Document token cleanup, avoid shared machines, prefer RUNCOMFY_TOKEN in CI, and never read or print token file contents.
  3. FIX-003
    Medium
    Biometric media is sent to external model APIs.
    Warn users before upload, accept only user-provided assets, and require clear consent for face, voice, and performance media.
  4. FIX-004
    Medium
    Third-party reference URLs can influence generated output.
    Use trusted HTTPS sources, reject unexpected assets, and review output divergence before publishing generated media.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
62e2a730c5cd74eab4c7164309d810de660fcea3
Content hash
676d8f22c561891df78cf75dcd7364349bdcc48c317d9268c7eadeebca9ef2cf
Tree hash
9983b6d6a3bb3468318713cb3c27c8449a1f7da43a4cf5ef93442ab7fc1e03b9
Skill path
skills/runcomfy-com/face-swap
Audit payload hash
2d658b84ad345c16c0f7c91225fd65b6

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable