Most static findings are false positives from Markdown backticks, fenced examples, and abbreviated HTTP paths. Confirmed residual risk is limited to intended RunComfy CLI execution and network submission of prompts and bearer-token-authenticated requests. A high-confidence semantic supply-chain issue remains because install instructions reference a different GitHub repository than the reviewed source metadata.
The skill links to and installs from agentspace-so/runcomfy-skills while the reviewed source metadata points to runcomfy-com/skills. This can route users to code that differs from the reviewed source.
The GitHub link and npx install command name agentspace-so/runcomfy-skills, while the report metadata identifies runcomfy-com/skills as the reviewed source. This is a clear supply-chain consistency issue, although ownership relationship is not proven from the file alone.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through
The skill states that it calls the local RunComfy CLI to launch a hosted text-to-video job. The command is fixed and legitimate, but it is still an external process that sends user content outside the local environment.
The fenced block contains an npx/global skill installation command. This appears legitimate, but running it executes external tooling and should require explicit user confirmation.
Line 44 instructs users to install the RunComfy CLI globally through npm. This is a normal prerequisite, but it executes package manager code outside the skill itself.
Line 45 instructs users to run runcomfy login, which starts an authentication flow for account access. The action is expected, but it handles credentials and should be user-approved.
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matchin
The skill explicitly says it invokes runcomfy run with a JSON body. This is intended external CLI behavior rather than arbitrary execution, so the risk is limited but real.
2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide
Line 179 identifies a POST to the RunComfy model API using the user bearer token. This is intended service use, but it is real network egress of prompt data and credentials.
Most static findings are false positives from Markdown backticks, fenced examples, and abbreviated HTTP paths. Confirmed residual risk is limited to intended RunComfy CLI execution and network submission of prompts and bearer-token-authenticated requests. A high-confidence semantic supply-chain issue remains because install instructions reference a different GitHub repository than the reviewed source metadata.
The skill links to and installs from agentspace-so/runcomfy-skills while the reviewed source metadata points to runcomfy-com/skills. This can route users to code that differs from the reviewed source.
The GitHub link and npx install command name agentspace-so/runcomfy-skills, while the report metadata identifies runcomfy-com/skills as the reviewed source. This is a clear supply-chain consistency issue, although ownership relationship is not proven from the file alone.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Calls `runcomfy run happyhorse/happyhorse-1-0/text-to-video` through
The skill states that it calls the local RunComfy CLI to launch a hosted text-to-video job. The command is fixed and legitimate, but it is still an external process that sends user content outside the local environment.
The fenced block contains an npx/global skill installation command. This appears legitimate, but running it executes external tooling and should require explicit user confirmation.
Line 44 instructs users to install the RunComfy CLI globally through npm. This is a normal prerequisite, but it executes package manager code outside the skill itself.
Line 45 instructs users to run runcomfy login, which starts an authentication flow for account access. The action is expected, but it handles credentials and should be user-approved.
1. The skill invokes `runcomfy run happyhorse/happyhorse-1-0/text-to-video` with a JSON body matchin
The skill explicitly says it invokes runcomfy run with a JSON body. This is intended external CLI behavior rather than arbitrary execution, so the risk is limited but real.
2. The CLI POSTs to `https://model-api.runcomfy.net/v1/models/happyhorse/happyhorse-1-0/text-to-vide
Line 179 identifies a POST to the RunComfy model API using the user bearer token. This is intended service use, but it is real network egress of prompt data and credentials.
Static analysis reported many high-risk hits, but most are false positives caused by markdown backticks, model version text, and shorthand URLs. Confirmed risks are intended external CLI execution, outbound RunComfy API calls, environment token use, token file storage, and generated output downloads. No prompt injection, malicious exfiltration, or hidden execution was found in SKILL.md.
1
Files scanned
196
Lines analyzed
7
Review items
2
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill directs users to install and run the RunComfy CLI, including npx installation and runcomfy execution. This is core functionality, but it executes local commands and depends on the installed package.
The command examples and workflow explicitly invoke runcomfy and npx. The usage appears legitimate for this skill, but local command execution is a real operational risk.
The skill states that prompts and a bearer token are sent to the RunComfy Model API over HTTPS. This is expected behavior, but it exposes user prompts and credentials to a third-party service.
The documentation directly names the RunComfy API endpoint and bearer token use. There is no evidence of unauthorized endpoints, but the data leaves the local machine.
The skill documents token storage under the user config directory and downloads generated media to an output directory. These filesystem writes are legitimate, but users should understand where credentials and outputs are stored.
The file locations and download behavior are documented in the skill. The text also describes owner-only token permissions, which reduces but does not remove the risk.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Markdown Backtick Findings Are Mostly False Positives
The scanner reported many Ruby backtick execution findings, but SKILL.md is markdown documentation. The backticks wrap CLI names, endpoint names, schema fields, and prompt examples rather than executable Ruby code.
The scanned file is markdown, and the flagged backticks are inline formatting or fenced command examples. No Ruby code or dynamic shell interpolation is present in the skill file.
Weak Crypto And Path Traversal Hits Are False Positives
The weak cryptography hits correspond to version text, sample prose, and exit-code documentation. The path traversal hits are shorthand request URLs, not filesystem traversal or untrusted path construction.
Manual review found no cryptographic implementation and no filesystem path traversal logic. The flagged text is descriptive documentation only.
This is a legitimate AI video generation skill for RunComfy's HappyHorse 1.0 model. The static analyzer flagged 86 potential issues, but evaluation reveals most are false positives from markdown code blocks being misidentified as executable code. The skill legitimately invokes the RunComfy CLI to call an external API for video generation. No malicious intent detected. Security documentation is comprehensive.
1
Files scanned
196
Lines analyzed
3
Review items
2
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill invokes the RunComfy CLI (`runcomfy run`) to execute video generation requests. While this is legitimate functionality for an AI video service, external command execution is a risk factor that warrants warning for users.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
The static analyzer flagged 66 'external_commands' patterns (Ruby/shell backtick execution) and 9 'weak cryptographic algorithm' flags, but these are all in markdown code blocks showing bash command examples. The SKILL.md file is documentation, not executable code. No actual shell execution occurs from this file.
SKILL.md is a markdown documentation file containing bash command examples in code blocks (```bash ... ```). The 'backtick execution' detection is a false positive - these are not Ruby scripts with actual backtick operators, but documentation showing CLI command syntax.
The static analyzer flagged path traversal sequences at lines 180-182, but these are legitimate CLI operations: the CLI downloads generated video outputs and polls an API endpoint. These are expected filesystem operations for a video generation tool.
The flagged 'path traversal' patterns are part of legitimate CLI workflow documented in lines 180-182: downloading video outputs from `.runcomfy.net` or `.runcomfy.com` URLs. This is not an attack but expected file download functionality.