Skip to content
skillsafebeta
← Report library
Purpose / Other

Image To Video Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation executes remote npm/npx software and installs the CLI globally

Source references: 3
What we found

The instructions require a global npm installation of the RunComfy CLI and show an npx command that retrieves and executes software from an external repository. Neither command pins a version or commit, so executed content can change upstream.

Why this matters

If a package, repository, dependency, or publisher account is compromised, installer code could read files, access credentials, or alter the user's environment with the current user's privileges. A global install also creates persistent changes outside the project.

The instructions globally install an unpinned RunComfy npm package and use npx to install the Skill from an external repository without a pinned commit. These steps execute and persist whatever code upstream supplies at that time, while global installation broadens local impact. Users can request pinned package and commit versions and inspect them in an isolated environment first.

SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Show 2 other places
SKILL.md:48In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.
SKILL.md:46In the instructionsOpen original file
## Prerequisites1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Images, voices, and reference videos are sent to the third-party RunComfy service

Source references: 3
What we found

Calls send JSON containing image_url, video_url, or audio_url to the RunComfy Model API, whose server then fetches the media. Faces, voices, unreleased product material, or private URLs bearing access tokens may therefore leave the user's controlled environment.

Why this matters

The third party may receive sensitive media and access parameters embedded in URLs, creating privacy, biometric, confidentiality, or authorization risks. The document claims no telemetry, but no CLI implementation is included here for independent verification.

The invocation sends JSON containing media URLs to RunComfy, whose servers then fetch the media. If users supply faces, voices, reference videos, or URLs granting private access, that material is processed by a third party. Retention and downstream-use terms are not shown; users can restrict inputs to non-sensitive media and short-lived, least-privilege URLs, and request the service's data-handling terms.

SKILL.md:144In the instructionsOpen original file
| `prompt` | string | yes | — | CN ≤500 chars OR EN ≤1000 words. || `image_url` | array | yes (for i2v) | `[]` | 0–9 images. **First is the primary subject.** || `video_url` | array | no | `[]` | 0–3 reference clips (MP4/MOV), 2–15s each. || `audio_url` | array | no | `[]` | 0–3 reference audio (WAV/MP3), 2–15s, < 15MB each. || `aspect_ratio` | enum | no | `adaptive` | `adaptive`, `16:9`, `9:16`, `4:3`, `3:4`, `1:1`, `21:9`. |
Show 2 other places
SKILL.md:197In the instructionsOpen original file
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:203In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

The CLI persistently stores a login token and writes generated files to a chosen directory

Source references: 4
What we found

Device login is described as writing an API token into the user's configuration directory, while each run downloads remote results into --output-dir. Although the document claims mode 0600 for the token and a 2 GiB per-file cap, these are still persistent local writes.

Why this matters

The token remains until removed or revoked and may be accessible to software running as the same user. A mistaken output path, filename collision, or repeated generation could consume storage or affect existing files; the supplied material does not state how name collisions are handled.

Legitimate use of this code

These are normal, disclosed writes needed to authenticate and save requested results. The token has a specified location and claimed owner-only mode 0600, with an environment-variable alternative; output goes to the caller-selected directory and has a 2 GiB per-file cap. The cited source does not show arbitrary overwrites, extra file collection, or hidden persistence. Users should still choose a dedicated output directory and protect the environment variable.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:197In the instructionsOpen original file
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
Show 3 other places
SKILL.md:201In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600 (owner-only read/write). Set `RUNCOMFY_TOKEN` env var to bypass the file entirely in CI / containers.- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.
SKILL.md:205In the instructionsOpen original file
- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
SKILL.md:204In the instructionsOpen original file
- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB to prevent disk-fill from a malicious or runaway model output.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 2
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command references an external repository without a version or commit. Running it later may cause npx to fetch and execute upstream content that has changed; users can ask the author for a pinned release or commit and a verification method.

SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Show 1 other places
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

The “image animation with custom voiceover” route does not submit the source image

Source references: 4
What we found

The routing table assigns Wan 2.7 to animation with custom-voiceover lip-sync, but it invokes a text-to-video endpoint whose schema and example contain text and audio only—no image_url. The instructions also acknowledge that this is not the primary image-to-video endpoint.

Why this matters

When the user expects the original person's identity to be preserved, the agent may instead generate a new text-and-audio-driven talking head, producing the wrong identity or result and potentially consuming an unwanted remote generation call.

The routing table presents custom-voiceover animation as an image-to-video use, but the Wan invocation explicitly uses a text-to-video endpoint whose schema and example contain no image_url. The text further describes a generated talking-head clip. Choosing this route therefore does not submit the source image and may not preserve its person or composition; users should confirm that text-generated video is acceptable or require an endpoint that actually accepts the image.

SKILL.md:38In the instructionsOpen original file
| Native synchronized ambient audio in one pass | **HappyHorse 1.0 I2V** | In-pass audio synthesis || Animate **and** lip-sync to a **custom voiceover track** | **Wan 2.7 + `audio_url`** | Accepts your own MP3/WAV (3–30s, ≤15MB) and drives lip-sync to it || Multi-language dub variants (same image, different audio per call) | **Wan 2.7 + `audio_url`** | Same shot, swap `audio_url` per language |
Show 3 other places
SKILL.md:95In the instructionsOpen original file
**Model**: `wan-ai/wan-2-7/text-to-video` (NOT `/image-to-video` — Wan 2.7's t2v endpoint accepts an `audio_url` that drives lip-sync)**Note on i2v with Wan 2.7**: Wan 2.7's primary i2v animation isn't on a dedicated endpoint here. For pure i2v (image animated by motion prompt only), prefer **HappyHorse i2v**. Use Wan 2.7 specifically when the user has a custom audio track they want lip-synced to a generated talking-head clip.
SKILL.md:103In the instructionsOpen original file
|---|---|---|---|---|| `prompt` | string | yes | — | Up to ~5000 chars. Describe the talking-head shot: framing, lighting, motion. || `audio_url` | string | yes (for lip-sync) | — | WAV/MP3, 3–30s, ≤15MB. **Drives lip-sync.** || `aspect_ratio` | enum | no | `16:9` | `16:9`, `9:16`, `1:1`, `4:3`, `3:4`. |
SKILL.md:114In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \  --input '{    "prompt": "Medium close-up of a confident spokesperson in a softly-lit recording booth, leaning slightly toward the camera, locked tripod, shallow DOF, warm key light from camera-left.",    "audio_url": "https://.../voiceover-en.mp3",    "duration": 12,    "aspect_ratio": "9:16"  }' \  --output-dir <absolute/path>```
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a RunComfy model-routing guide: it selects HappyHorse, Wan 2.7, or Seedance 2.0 Pro based on the user's intent and submits the request through the local RunComfy CLI.

View source
SKILL.md:44In the instructionsOpen original file
The agent reads this table, classifies the user's intent, and picks the matching subsection below.
SKILL.md:197In the instructionsOpen original file
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Use requires installing a third-party CLI, signing in to RunComfy or supplying an API token, and providing source-media URLs reachable by the service.

View source
SKILL.md:48In the instructionsOpen original file
1. **RunComfy CLI** — `npm i -g @runcomfy/cli`2. **RunComfy account** — `runcomfy login` opens a browser device-code flow.3. **CI / containers** — set `RUNCOMFY_TOKEN=<token>`.4. **A source image URL** — JPEG/PNG/WebP, min 300px, ≤10MB; aspect 1:2.5 to 2.5:1 (HappyHorse) — other models have similar specs.

Generation occurs through a remote Model API; the remote service fetches submitted media URLs, and the CLI polls and downloads results to the selected directory.

View source
SKILL.md:197In the instructionsOpen original file
The skill picks one of HappyHorse 1.0 I2V / Wan 2.7 t2v+audio / Seedance 2.0 Pro based on user intent and invokes `runcomfy run <model_id>` with the matching JSON body. The CLI POSTs to the Model API, polls the request, fetches the result, and downloads any `.runcomfy.net`/`.runcomfy.com` URL into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:203In the instructionsOpen original file
- **Input boundary**: the user prompt is passed as a JSON string to the CLI via `--input`. The CLI does NOT shell-expand the prompt; it transmits the JSON body directly to the Model API over HTTPS. No shell injection surface from prompt content.- **Third-party content**: image / mask / video URLs you pass are fetched by the RunComfy model server, not by the CLI on your machine. Treat external URLs as untrusted; image-based prompt injection is a known risk for any image-edit / video-edit model.- **Outbound endpoints**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated outputs). No telemetry, no callbacks.
Start here · InstructionsSKILL.md
image-to-video
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
  this move", or any explicit ask to turn a still into video.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:23In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [HappyHorse I2V](https://www.runcomfy.com/models/happyhorse/happyhorse-1-0/image-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [Wan 2.7](https://www.runcomfy.com/models/wan-ai/wan-2-7/text-to-video?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [Seedance 2.0 Pro](https://www.runcomfy.com/models/bytedance/seedance-v2/pro?utm_source=skills.sh&utm_medium=skill&utm_campaign=image-to-video) · [GitHub](https://github.com/agentspace-so/runcomfy-skills/tree/main/image-to-video)
SKILL.md:77In the instructionsOpen original file
  --input '{    "image_url": "https://.../portrait.jpg",    "prompt": "Gentle camera drift around the subject'\''s face, subtle breathing motion, identity-stable features, soft natural light."
Run commands
SKILL.md:27In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g
SKILL.md:74In the instructionsOpen original file
```bashruncomfy run happyhorse/happyhorse-1-0/image-to-video \
SKILL.md:113In the instructionsOpen original file
```bashruncomfy run wan-ai/wan-2-7/text-to-video \
Install extra software packages
SKILL.md:28In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-skills --skill image-to-video -g```
Lines read
206
File checksum (to compare versions)
a8f617611ed267cf21683e39c76b9514ec0f12e2f3e02e5f916c143bf8c3aa1b