Versioned security assessment

Report ID: SA-B23DD661

6/30/2026, 11:32:18 AM

runcomfy-cli security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
runcomfy-cli
Version
v2
Maintainer
runcomfy-com
Source
github.com/runcomfy-com/skills/tree/main/runcomfy-cli/
Coverage
1 Files scanned · 272 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static external command and URL findings are mostly expected documentation for a RunComfy CLI skill, not evidence of malware. Confirmed risks are the authenticated network workflow, local token handling, environment token use, and generated output downloads. No prompt injection attempt or confirmed malicious intent was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 272 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 7 evidence locations

Capability review items (4)
Medium
SKILL.md:240-246SKILL.md:257
Networked CLI Sends User Inputs to RunComfy
TRUE POSITIVE. The skill instructs agents to run RunComfy commands that submit prompts and assets to model-api.runcomfy.net, poll jobs, and download results. This is expected functionality but requires user awareness because inputs and media URLs leave the local environment.
The documented workflow explicitly describes POST, GET, DELETE, and download behavior against RunComfy domains. The endpoints are disclosed and aligned with the skill purpose, so this is a legitimate but real data-flow risk.
Medium
SKILL.md:65SKILL.md:70-72SKILL.md:164SKILL.md:251
Credential Storage and Environment Token Use
TRUE POSITIVE. The skill documents token storage in ~/.config/runcomfy/token.json and RUNCOMFY_TOKEN for CI. It includes safeguards against logging or committing tokens, but the skill still handles credentials.
The credential file path and environment variable are named directly in the skill. The same section contains protective guidance, reducing concern about malicious intent but not removing credential-handling risk.
Medium
SKILL.md:170-175SKILL.md:192-198SKILL.md:215-222SKILL.md:252
Shell Scripting Examples Need Trusted Inputs
TRUE POSITIVE as operational risk, not malicious code. Batch and polling examples use command substitution, jq, date, and retry logic. Users should avoid inserting untrusted shell fragments into these examples.
The examples are ordinary shell automation and one example uses jq to JSON-encode prompt text. Risk depends on user modification, so confidence is high for operational concern but not for exploitation.
Low
SKILL.md:252-257
Prompt Injection Attempt Not Found
No prompt injection attempt was found. The file discusses indirect prompt injection in third-party media as a threat model and provides mitigations rather than overriding evaluator instructions.
The relevant text names third-party content as untrusted and limits URL ingestion. I did not find phrases asking the evaluator or agent to ignore prior instructions or change security decisions.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (3)
Low
SKILL.md:20SKILL.md:28SKILL.md:242-244SKILL.md:257
Hardcoded RunComfy URLs Are Expected
FALSE POSITIVE for exfiltration. The URLs point to RunComfy homepage, documentation, catalog pages, API endpoints, and output download domains disclosed by the skill. No unrelated callback endpoint was found.
The network destinations are first-party RunComfy domains and match the described CLI service. I did not find evidence of hidden or unrelated third-party exfiltration endpoints.
Low
SKILL.md:65SKILL.md:114SKILL.md:121SKILL.md:155SKILL.md:251SKILL.md:258
Filesystem Findings Are Documented Storage and Downloads
PARTIAL TRUE POSITIVE. The hidden home path is documented credential storage and output-dir downloads write files. The path traversal flag on the example URL is only an ellipsis placeholder.
The file paths are explicitly described and mostly expected for login and downloads. The line 114 traversal signal is not a filesystem operation, so that specific static finding is a false positive.
Low
SKILL.md:5SKILL.md:224
Weak Cryptography Static Findings Not Confirmed
FALSE POSITIVE. Lines 5 and 224 are front matter and an exit-code heading. No hashing, encryption, or weak cryptographic algorithm usage was found.
The cited locations contain descriptive markdown, not executable cryptographic code. No evidence found for MD5, SHA1, DES, or similar weak algorithm use.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable